roster-server 3.2.0 → 3.2.1

package/index.js

@@ -139,6 +139,12 @@ function buildCertLookupCandidates(servername) {
     return candidates;
 }
 
+// The certificate stored for a host's own subject serves it; a wildcard or zone
+// certificate found as a fallback serves only the names it covers.
+function certDirServesHost(certDir, host, certificate) {
+    return certDirCandidatesForSubject(host).includes(certDir) || certificate.checkHost(host) !== undefined;
+}
+
 function certCoversName(certPem, name) {
     try {
         const x509 = new crypto.X509Certificate(certPem);
@@ -887,7 +893,7 @@ class Roster {
         const candidates = buildCertLookupCandidates(host);
         for (const candidate of candidates) {
             const pems = this._loadCert(candidate);
-            if (pems) return pems;
+            if (pems && certDirServesHost(candidate, host, new crypto.X509Certificate(pems.cert))) return pems;
         }
         return null;
     }
@@ -1096,8 +1102,8 @@ class Roster {
                 pending = this._loadSecureContext(subject).finally(() => this._contextLoads.delete(subject));
                 this._contextLoads.set(subject, pending);
             }
-            const context = await pending;
-            if (context) return context;
+            const loaded = await pending;
+            if (loaded && certDirServesHost(subject, host, loaded.certificate)) return loaded.context;
         }
         return null;
     }
@@ -1116,12 +1122,16 @@ class Roster {
         this._assertOpen();
         const version = stats.map(stat => `${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`).join('|');
         const cached = this._secureContexts.get(subject);
-        if (cached && cached.version === version) return cached.context;
+        if (cached && cached.version === version) return cached;
         const [key, cert, chain] = await Promise.all(files.map(file => fs.promises.readFile(file, 'utf8')));
         this._assertOpen();
-        const context = tls.createSecureContext({ key, cert: cert + chain });
-        this._secureContexts.set(subject, { version, context });
-        return context;
+        const loaded = {
+            version,
+            context: tls.createSecureContext({ key, cert: cert + chain }),
+            certificate: new crypto.X509Certificate(cert)
+        };
+        this._secureContexts.set(subject, loaded);
+        return loaded;
     }
 
     _checkCertificate(servername) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roster-server",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
   "main": "index.js",
   "repository": {

package/test/https-integration.test.js

@@ -32,8 +32,9 @@ function certificate(roster, subject, serial) {
     const key = path.join(directory, 'privkey.pem');
     const cert = path.join(directory, 'cert.pem');
     const keyArgs = fs.existsSync(key) ? ['-key', key] : ['-newkey', 'rsa:2048', '-nodes', '-keyout', key];
-    execFileSync('openssl', ['req', '-x509', ...keyArgs, '-out', cert,
-        '-subj', '/CN=example.com', '-days', '1', '-set_serial', String(serial)], { stdio: 'ignore' });
+    const name = subject.replace(/^_wildcard_\./, '*.');
+    execFileSync('openssl', ['req', '-x509', ...keyArgs, '-out', cert, '-subj', '/CN=example.com',
+        '-addext', `subjectAltName=DNS:${name}`, '-days', '1', '-set_serial', String(serial)], { stdio: 'ignore' });
     fs.writeFileSync(path.join(directory, 'chain.pem'), '');
     return directory;
 }

package/test/static-and-tls.test.js

@@ -218,6 +218,44 @@ it('reuses TLS contexts, coalesces concurrent loads, and reloads changed certifi
     assert.equal(roster._secureContexts.size, 0);
 });
 
+function installCertificate(root, directoryName, names) {
+    const directory = path.join(root, 'live', directoryName);
+    fs.mkdirSync(directory, { recursive: true });
+    execFileSync('openssl', ['req', '-x509', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:P-256', '-nodes',
+        '-keyout', path.join(directory, 'privkey.pem'), '-out', path.join(directory, 'cert.pem'),
+        '-subj', `/CN=${names[0]}`, '-addext', `subjectAltName=${names.map(name => `DNS:${name}`).join(',')}`,
+        '-days', '1'], { stdio: 'ignore' });
+    fs.writeFileSync(path.join(directory, 'chain.pem'), '');
+}
+
+it('falls back to zone and wildcard certificates only when they cover the host', async t => {
+    const root = temporaryDirectory(t);
+    installCertificate(root, 'example.com', ['example.com', 'www.example.com']);
+    installCertificate(root, '_wildcard_.wild.example.com', ['*.wild.example.com']);
+    const roster = new Roster({ local: true, wwwPath: root, greenlockStorePath: root });
+    t.after(() => roster.close());
+    const issued = [];
+    roster._greenlockRuntime = {
+        get: async ({ servername }) => {
+            issued.push(servername);
+            installCertificate(root, servername, [servername]);
+        }
+    };
+
+    const www = await roster._getSecureContext('www.example.com');
+    assert.equal(www, roster._secureContexts.get('example.com').context);
+    const wild = await roster._getSecureContext('shop.wild.example.com');
+    assert.equal(wild, roster._secureContexts.get('_wildcard_.wild.example.com').context);
+    assert.deepEqual(issued, []);
+
+    const uncovered = await roster._getSecureContext('api.example.com');
+    assert.deepEqual(issued, ['api.example.com']);
+    assert.equal(uncovered, roster._secureContexts.get('api.example.com').context);
+
+    assert.match(roster._resolvePemsForServername('www.example.com').cert, /BEGIN CERTIFICATE/);
+    assert.equal(roster._resolvePemsForServername('mail.example.com'), null);
+});
+
 it('coalesces certificate checks and prevents new issuance after close', async t => {
     const root = temporaryDirectory(t);
     const roster = new Roster({ local: true, wwwPath: root });