sliftutils 1.7.136 → 1.7.138

package/storage/remoteStorage/storageController.ts

@@ -5,7 +5,7 @@ import { setHTTPResultHeaders, getCurrentHTTPRequest } from "socket-function/src
 import { performLocalCall } from "socket-function/src/callManager";
 import { RequireController } from "socket-function/require/RequireController";
 import { timeInMinute } from "socket-function/src/misc";
-import { getCommonName, getPublicIdentifier, getOwnMachineId, verify, verifyMachineIdForPublicKey } from "../../misc/https/certs";
+import { getCommonName, getMachineId, getOwnMachineId, validateCertificate, verify } from "../../misc/https/certs";
 import { ArchiveFileInfo, ArchivesConfig, ArchivesSyncStatus, FindConfig, SourceConfig, IMMUTABLE_CACHE_TIME } from "../IArchives";
 import { ROUTING_FILE, getRoute, routeContains } from "./remoteConfig";
 import {
@@ -43,6 +43,7 @@ export type AuthTokenData = {
 };
 export type AuthToken = {
     certPem: string;
+    issuerPem: string;
     signature: string;
     data: AuthTokenData;
 };
@@ -50,9 +51,8 @@ export type AccessState = {
     machineId: string;
     ip: string;
     hasAccess: boolean;
-    // Why not, and what to run about it, when there is no access.
+    // Why not, including the command that grants access, when there is no access.
     reason?: string;
-    addMachineCommand?: string;
     // Everything the repo trusts, when there is.
     trustedMachines?: MachineState[];
 };
@@ -122,7 +122,7 @@ async function requireAccess(account: string): Promise<string> {
     if (!verdict.accepted) {
         throw new Error(
             `${STORAGE_ACCESS_DENIED} ${verdict.reason}`
-            + ` Machine ${machineId}, address ${ip}, account ${JSON.stringify(account)}.`
+            + ` Machine ${machineId} was calling from ${ip}, for account ${JSON.stringify(account)}.`
         );
     }
     return machineId;
@@ -134,8 +134,11 @@ class RemoteStorageControllerBase {
         return {};
     }
 
+    // Secure because connections use real certificates on real domain names, so TLS itself stops a
+    // man-in-the-middle. Otherwise one would be possible: the signed token only names the server's
+    // domain, so a middleman on the path to that domain could reuse it against the real server.
     async authenticate(token: AuthToken): Promise<{ machineId: string; ip: string }> {
-        let { domain, port } = getStorageServerConfig();
+        let { domain, port, rootDomain } = getStorageServerConfig();
         let caller = SocketFunction.getCaller();
         verify(token.certPem, token.signature, token.data);
         let { purpose, time, server } = token.data;
@@ -149,10 +152,8 @@ class RemoteStorageControllerBase {
         if (tokenDomain !== domain) {
             throw new Error(`Auth token is for server ${JSON.stringify(server)}, but this server is ${JSON.stringify(`${domain}:${port}`)}`);
         }
-        let machineId = getCommonName(token.certPem).split(".")[0];
-        if (!verifyMachineIdForPublicKey({ machineId, publicKey: getPublicIdentifier(token.certPem) })) {
-            throw new Error(`Certificate common name does not match its public key: ${JSON.stringify(getCommonName(token.certPem))}`);
-        }
+        validateCertificate(rootDomain, token.certPem, token.issuerPem);
+        let machineId = getMachineId(getCommonName(token.issuerPem), rootDomain);
         sessions.set(caller.nodeId, machineId);
         while (sessions.size > MAX_SESSIONS) {
             let oldest = sessions.keys().next().value;
@@ -183,7 +184,6 @@ class RemoteStorageControllerBase {
                 ip,
                 hasAccess: false,
                 reason: verdict.reason,
-                addMachineCommand: `yarn addmachine ${rootDomain} ${machineId} ${ip} git`,
             };
         }
         return { machineId, ip, hasAccess: true, trustedMachines: await getTrustedMachines() };