From d80621146324741613c17df8bfac2bc53a111c4c Mon Sep 17 00:00:00 2001 From: "Hung-Han (Henry) Chen" Date: Mon, 1 Nov 2021 09:09:55 +0200 Subject: [PATCH] Export injectSystemCAs and used in main/renderer Signed-off-by: Hung-Han (Henry) Chen --- src/common/system-ca.ts | 53 +++++++++++++++++++++++---------------- src/main/index.ts | 4 ++- src/renderer/lens-app.tsx | 3 ++- 3 files changed, 37 insertions(+), 23 deletions(-) diff --git a/src/common/system-ca.ts b/src/common/system-ca.ts index 8b8177097b..a15f93c04b 100644 --- a/src/common/system-ca.ts +++ b/src/common/system-ca.ts @@ -28,17 +28,17 @@ import { promiseExec } from "./utils/promise-exec"; // DST Root CA X3, which was expired on 9.30.2021 export const DSTRootCAX3 = "-----BEGIN CERTIFICATE-----\nMIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow\nPzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD\nEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O\nrz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq\nOLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b\nxiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw\n7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD\naeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV\nHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG\nSIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69\nikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr\nAvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz\nR8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5\nJDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo\nOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ\n-----END CERTIFICATE-----\n"; -export const isCertActive = (cert: string) => { +export function isCertActive (cert: string) { const isExpired = typeof cert !== "string" || cert.includes(DSTRootCAX3); return !isExpired; -}; +} /** * Get root CA certificate from MacOSX system keychain * Only return non-expred certificates. */ -export const getMacRootCA = async () => { +export async function getMacRootCA () { // inspired mac-ca https://github.com/jfromaniello/mac-ca const args = "find-certificate -a -p"; // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Cheatsheet#other_assertions @@ -49,13 +49,13 @@ export const getMacRootCA = async () => { const rootCA = (await promiseExec(`${bin} ${args} ${systemRootCertsPath}`)).stdout.toString().split(splitPattern); return [...new Set([...trusted, ...rootCA])].filter(isCertActive); -}; +} /** * Get root CA certificate from Windows system certificate store. * Only return non-expred certificates. */ -export const getWinRootCA = (): Promise => { +export function getWinRootCA (): Promise { return new Promise((resolve) => { const CAs: string[] = []; @@ -70,12 +70,13 @@ export const getWinRootCA = (): Promise => { } }); }); -}; +} + /** * Add (or merge) CAs to https.globalAgent.options.ca */ -export const injectCAs = (CAs: string[]) => { +export function injectCAs (CAs: string[]) { for (const cert of CAs) { if (Array.isArray(https.globalAgent.options.ca) && !https.globalAgent.options.ca.includes(cert)) { https.globalAgent.options.ca.push(cert); @@ -83,20 +84,30 @@ export const injectCAs = (CAs: string[]) => { https.globalAgent.options.ca = [cert]; } } -}; - -if (isMac) { - getMacRootCA().then((osxRootCAs) => { - injectCAs(osxRootCAs); - }).catch((error) => { - console.warn(`[MAC-CA]: Error injecting root CAs from MacOSX. ${error?.message}`); - }); } -if (isWindows) { - getWinRootCA().then((winRootCAs) => { - wincaAPI.inject("+", winRootCAs); - }).catch((error) => { - console.warn(`[WIN-CA]: Error injecting root CAs from Windows. ${error?.message}`); - }); +/** + * Inject CAs found in OS's (Windoes/MacOSX only) root certificate store to https.globalAgent.options.ca + */ +export async function injectSystemCAs () { + if (isMac) { + try { + const osxRootCAs = await getMacRootCA(); + + injectCAs(osxRootCAs); + } catch (error) { + console.warn(`[MAC-CA]: Error injecting root CAs from MacOSX. ${error?.message}`); + } + } + + if (isWindows) { + try { + const winRootCAs = await getWinRootCA(); + + wincaAPI.inject("+", winRootCAs); + + } catch (error) { + console.warn(`[WIN-CA]: Error injecting root CAs from Windows. ${error?.message}`); + } + } } diff --git a/src/main/index.ts b/src/main/index.ts index 786a79a7b7..4b1457395d 100644 --- a/src/main/index.ts +++ b/src/main/index.ts @@ -21,7 +21,7 @@ // Main process -import "../common/system-ca"; +import { injectSystemCAs } from "../common/system-ca"; import { initialize as initializeRemote } from "@electron/remote/main"; import * as Mobx from "mobx"; import * as LensExtensionsCommonApi from "../extensions/common-api"; @@ -121,6 +121,8 @@ app.on("second-instance", (event, argv) => { }); app.on("ready", async () => { + await injectSystemCAs(); + logger.info(`🚀 Starting ${productName} from "${AppPaths.get("exe")}"`); logger.info("🐚 Syncing shell environment"); await shellSync(); diff --git a/src/renderer/lens-app.tsx b/src/renderer/lens-app.tsx index 18be54e8e0..df6867c86b 100644 --- a/src/renderer/lens-app.tsx +++ b/src/renderer/lens-app.tsx @@ -19,7 +19,7 @@ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ -import "../common/system-ca"; +import { injectSystemCAs } from "../common/system-ca"; import React from "react"; import { Route, Router, Switch } from "react-router"; import { observer } from "mobx-react"; @@ -42,6 +42,7 @@ import { unmountComponentAtNode } from "react-dom"; @observer export class LensApp extends React.Component { static async init(rootElem: HTMLElement) { + await injectSystemCAs(); catalogEntityRegistry.init(); ExtensionLoader.getInstance().loadOnClusterManagerRenderer(); LensProtocolRouterRenderer.createInstance().init();