node-red-contrib-tdn-eventsub 0.2.1 → 0.2.2

package/README.md

@@ -39,6 +39,7 @@ Restart Node-RED. Nodes appear under **TDN REST**. Import the example via *Impor
 | Auth scheme | Authorization header only. Blank (default): `Authorization: Basic base64(":" + key)`, accepted by server v9.0+. For older servers enter the API-key scheme token from your server's REST API docs; the key is then sent as `Authorization: <scheme> <key>`. |
 | Header name | API key header only. Sent as `<header name>: <key>`; default `X-API-Key`. |
 | Cert fingerprint | Optional. SHA-256 (64 hex) or SHA-1 (40 hex) of the **server** certificate, colons optional. When set, the server's self-signed cert is accepted only if it matches; the check runs before any request is written, so the key is never sent to an impostor. A mismatch error prints the actual fingerprint. |
+| Plain HTTP (insecure) | Unencrypted `http://` whatever the URL says; certificate settings are ignored and the key travels in clear text. For bench testing against a non-TLS endpoint only. A TLS error like `unexpected message` or `wrong version number` usually means the endpoint needs this; the error text says so. |
 | Verify server certificate | Normal CA check when no fingerprint is set. |
 | Force links onto this host:port | The server builds `href`s from its own machine name. With this on, followed links keep path + query but use your configured host/port. With it off, a link that would downgrade `https` to `http` is refused. |
 | Client cert / key / PFX | Only if the REST Client item on the server has a thumbprint (pinned client certificate). |

package/examples/rest-basic.json

@@ -290,6 +290,7 @@
     "authScheme": "",
     "headerName": "X-API-Key",
     "fingerprint": "",
+    "plainHttp": false,
     "rejectUnauthorized": true,
     "rewriteHrefs": true,
     "timeout": 30000,

package/lib/client.js

@@ -84,6 +84,18 @@ function buildAuthHeaders(cred) {
     };
 }
 
+// OpenSSL errors seen when the other end isn't speaking TLS at all
+const NOT_TLS_CODES = ['ERR_SSL_WRONG_VERSION_NUMBER', 'ERR_SSL_UNEXPECTED_MESSAGE', 'ERR_SSL_PACKET_LENGTH_TOO_LONG', 'ERR_SSL_HTTP_REQUEST', 'ERR_SSL_RECORD_LAYER_FAILURE'];
+
+/** Add a hint to TLS handshake errors that usually mean the endpoint is plain HTTP. */
+function notTlsHint(e) {
+    if (e && NOT_TLS_CODES.includes(e.code)) {
+        e.message = `TLS handshake failed (${e.code}): the endpoint may not be using TLS. ` +
+            'For a plain-HTTP endpoint tick "Plain HTTP (insecure)" in the server config. ' + e.message;
+    }
+    return e;
+}
+
 function abortError() {
     return new RestError('Request aborted', { code: 'ABORTED', aborted: true });
 }
@@ -101,6 +113,7 @@ class RestClient {
      * @param {boolean} [o.rejectUnauthorized] used only when no fingerprint is set
      * @param {string} [o.certPath] [o.keyPath] [o.pfxPath] [o.passphrase] client certificate
      * @param {boolean} [o.rewriteHrefs] force followed hrefs back onto the configured host:port
+     * @param {boolean} [o.plainHttp]    use unencrypted http:// whatever the URL says (bench/test only)
      * @param {number} [o.timeoutMs]    default request timeout
      */
     constructor(o) {
@@ -109,6 +122,7 @@ class RestClient {
         if (!raw) throw new RestError('No server URL configured');
         if (!/^https?:\/\//i.test(raw)) raw = 'https://' + raw;
         const u = new URL(raw);
+        if (o.plainHttp) u.protocol = 'http:';
         const port = parseInt(o.port, 10);
         if (port > 0) u.port = String(port);
         else if (!u.port) u.port = String(DEFAULT_PORT);
@@ -230,7 +244,7 @@ class RestClient {
             if (!net.isIP(host)) opts.servername = host;
 
             sock = tls.connect(opts);
-            sock.once('error', (e) => finish(e));
+            sock.once('error', (e) => finish(notTlsHint(e)));
             sock.once('secureConnect', () => {
                 if (pinning) {
                     const c = sock.getPeerCertificate();

package/nodes/rest-server.html

@@ -16,6 +16,7 @@
                     return h.length === 40 || h.length === 64;
                 }
             },
+            plainHttp: { value: false },
             rejectUnauthorized: { value: true },
             rewriteHrefs: { value: true },
             timeout: { value: 30000, validate: RED.validators.number() },
@@ -39,6 +40,13 @@
             if (!this.authType) $('#node-config-input-authType').val('authorization');
             $('#node-config-input-authType').on('change', sync);
             sync();
+            var syncTls = function () {
+                var plain = $('#node-config-input-plainHttp').is(':checked');
+                $('.tdn-rest-tls').toggle(!plain);
+                $('.tdn-rest-plain-warning').toggle(plain);
+            };
+            $('#node-config-input-plainHttp').on('change', syncTls);
+            syncTls();
         }
     });
 </script>
@@ -76,10 +84,16 @@
         <input type="text" id="node-config-input-headerName" placeholder="X-API-Key">
     </div>
     <div class="form-row">
+        <label>&nbsp;</label>
+        <input type="checkbox" id="node-config-input-plainHttp" style="display:inline-block;width:auto;vertical-align:top">
+        <label for="node-config-input-plainHttp" style="width:auto">Plain HTTP (insecure, no TLS)</label>
+    </div>
+    <div class="form-tips tdn-rest-plain-warning"><b>Insecure:</b> the API key and all data are sent unencrypted. Use only for bench testing against a non-TLS endpoint.</div>
+    <div class="form-row tdn-rest-tls">
         <label for="node-config-input-fingerprint"><i class="fa fa-certificate"></i> Cert fingerprint</label>
         <input type="text" id="node-config-input-fingerprint" placeholder="optional SHA-256 or SHA-1 of server cert">
     </div>
-    <div class="form-row">
+    <div class="form-row tdn-rest-tls">
         <label>&nbsp;</label>
         <input type="checkbox" id="node-config-input-rejectUnauthorized" style="display:inline-block;width:auto;vertical-align:top">
         <label for="node-config-input-rejectUnauthorized" style="width:auto">Verify server certificate against CA (ignored when a fingerprint is set)</label>
@@ -93,6 +107,7 @@
         <label for="node-config-input-timeout"><i class="fa fa-clock-o"></i> Timeout (ms)</label>
         <input type="text" id="node-config-input-timeout" placeholder="30000" style="width:100px">
     </div>
+    <div class="tdn-rest-tls">
     <hr>
     <div class="form-tips">Client certificate &mdash; only if the REST Client item on the server has a thumbprint set. Use PEM cert + key, <i>or</i> a PFX.</div>
     <div class="form-row">
@@ -111,6 +126,7 @@
         <label for="node-config-input-passphrase">Passphrase</label>
         <input type="password" id="node-config-input-passphrase">
     </div>
+    </div>
 </script>
 
 <script type="text/html" data-help-name="tdn-rest-server">
@@ -138,6 +154,10 @@
             When set, the connection is accepted only if the presented certificate matches, even if it is self-signed.
             The check happens before any request (and therefore the API key) is sent.
             A mismatch error reports the actual fingerprint so you can copy it.</dd>
+        <dt>Plain HTTP (insecure)</dt>
+        <dd>Connect with unencrypted <code>http://</code> whatever the URL says. The API key travels in clear text and the
+            certificate settings are ignored, so use it only for bench testing against a non-TLS endpoint. A TLS handshake error such as
+            <code>unexpected message</code> or <code>wrong version number</code> usually means the endpoint needs this.</dd>
         <dt>Verify server certificate</dt>
         <dd>Normal CA verification when no fingerprint is set. Untick only for lab use.</dd>
         <dt>Force returned links back onto this host:port</dt>

package/nodes/rest-server.js

@@ -16,6 +16,7 @@ module.exports = function (RED) {
         this.headerName = (config.headerName || '').trim();
         this.rejectUnauthorized = config.rejectUnauthorized !== false;
         this.rewriteHrefs = config.rewriteHrefs !== false;
+        this.plainHttp = config.plainHttp === true;
         this.timeout = parseInt(config.timeout, 10) || 30000;
         this.certPath = config.certPath;
         this.keyPath = config.keyPath;
@@ -36,13 +37,17 @@ module.exports = function (RED) {
                 fingerprint: this.fingerprint,
                 rejectUnauthorized: this.rejectUnauthorized,
                 rewriteHrefs: this.rewriteHrefs,
+                plainHttp: this.plainHttp,
                 timeoutMs: this.timeout,
                 certPath: this.certPath,
                 keyPath: this.keyPath,
                 pfxPath: this.pfxPath,
                 passphrase: creds.passphrase
             });
-            if (this.client.base.protocol === 'http:') this.warn('REST server URL is http:// - the API key will be sent unencrypted');
+            if (this.client.base.protocol === 'http:') {
+                this.warn('REST server uses plain HTTP - the API key will be sent unencrypted' +
+                    (this.fingerprint || this.certPath || this.pfxPath ? '; certificate settings are ignored' : ''));
+            }
         } catch (e) {
             this.clientError = e;
             this.error('REST server config: ' + e.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-red-contrib-tdn-eventsub",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Node-RED nodes for an access-control REST Server API: access groups, cardholders and items lists to global context, plus continuous item status subscriptions.",
   "main": "lib/client.js",
   "scripts": {