From 69cb2fe548bb34b4a489a4d990f35ffb2f57b44c Mon Sep 17 00:00:00 2001
From: Lloyd Hilaiel <lloyd@hilaiel.com>
Date: Tue, 15 Nov 2011 11:51:13 -0700
Subject: [PATCH] public and private keys explicitly read, whenever we can't
read them we go down with a hard error: closes #581, related to issue #576
---
lib/browserid/views.js | 9 ++++++++-
lib/configuration.js | 2 --
lib/keysigner/ca.js | 12 ++++++------
lib/secrets.js | 6 ++++--
lib/verifier/certassertion.js | 16 ++++++++++++----
5 files changed, 30 insertions(+), 15 deletions(-)
diff --git a/lib/browserid/views.js b/lib/browserid/views.js
index c39f16791..93de723d3 100644
--- a/lib/browserid/views.js
+++ b/lib/browserid/views.js
@@ -103,9 +103,16 @@ exports.setup = function(app) {
})(url, REDIRECTS[url]);
}
+ try {
+ const publicKey = secrets.loadPublicKey('root', config.get('var_path'));
+ } catch(e){
+ logger.error("can't read public key, exiting: " + e);
+ setTimeout(function() { process.exit(1); }, 0);
+ }
+
// the public key
app.get("/pk", function(req, res) {
- res.json(config.get('public_key').toSimpleObject());
+ res.json(publicKey.toSimpleObject());
});
// vep bundle of JavaScript
diff --git a/lib/configuration.js b/lib/configuration.js
index 97b6c8d40..c6afb609e 100644
--- a/lib/configuration.js
+++ b/lib/configuration.js
@@ -219,8 +219,6 @@ g_config['express_log_format'] = (exports.get('env') === 'production' ? 'default
// on the path, we'll use that, otherwise we'll name it 'ephemeral'.
g_config['process_type'] = path.basename(process.argv[1], ".js");
-g_config['public_key'] = secrets.loadPublicKey('root', exports.get('var_path'));
-
// only allow the dbwriter process to write to the database (or the unit tests)
g_config.database.may_write = (g_config.process_type === 'dbwriter' ||
g_config.process_type === 'vows' ||
diff --git a/lib/keysigner/ca.js b/lib/keysigner/ca.js
index 85a1215e3..8150c2022 100644
--- a/lib/keysigner/ca.js
+++ b/lib/keysigner/ca.js
@@ -47,11 +47,11 @@ var jwcert = require('jwcrypto/jwcert'),
var HOSTNAME = config.get('hostname');
-const secret_key = secrets.loadSecretKey('root', config.get('var_path'));
-
-if (!secret_key) {
- logger.error("no secret key read from " + config.get('var_path') +
- " can't continue");
+try {
+ const secret_key = secrets.loadSecretKey('root', config.get('var_path'));
+ const public_key = secrets.loadPublicKey('root', config.get('var_path'));
+} catch(e){
+ logger.error("can't read keys, exiting: " + e);
setTimeout(function() { process.exit(1); }, 0);
}
@@ -89,4 +89,4 @@ exports.certify = certify;
exports.verifyChain = verifyChain;
exports.parsePublicKey = parsePublicKey;
exports.parseCert = parseCert;
-exports.PUBLIC_KEY = config.get('public_key');
+exports.PUBLIC_KEY = public_key;
diff --git a/lib/secrets.js b/lib/secrets.js
index 41d53d024..b3ca9ad06 100644
--- a/lib/secrets.js
+++ b/lib/secrets.js
@@ -68,7 +68,8 @@ exports.loadSecretKey = function(name, dir) {
var fileExists = false;
var secret = undefined;
- try{ secret = fs.readFileSync(p).toString(); } catch(e) {};
+ // may throw
+ secret = fs.readFileSync(p).toString();
if (secret === undefined) {
return null;
@@ -83,7 +84,8 @@ exports.loadPublicKey = function(name, dir) {
var fileExists = false;
var secret = undefined;
- try{ secret = fs.readFileSync(p).toString(); } catch(e) {};
+ // may throw
+ secret = fs.readFileSync(p).toString();
if (secret === undefined) {
return null;
diff --git a/lib/verifier/certassertion.js b/lib/verifier/certassertion.js
index 618867087..44d113f31 100644
--- a/lib/verifier/certassertion.js
+++ b/lib/verifier/certassertion.js
@@ -45,15 +45,23 @@ jwk = require("jwcrypto/jwk"),
jwt = require("jwcrypto/jwt"),
jwcert = require("jwcrypto/jwcert"),
vep = require("jwcrypto/vep"),
-config = require("../../lib/configuration.js"),
-logger = require("../../lib/logging.js").logger;
+config = require("../configuration.js"),
+logger = require("../logging.js").logger,
+secrets = require('../secrets.js');
const HOSTMETA_URL = "/.well-known/host-meta";
var publicKeys = {};
-// set up some default public keys
-publicKeys[config.get('hostname')] = config.get('public_key');
+try {
+ const publicKey = secrets.loadPublicKey('root', config.get('var_path'));
+} catch(e){
+ logger.error("can't read public key, exiting: " + e);
+ setTimeout(function() { process.exit(1); }, 0);
+}
+
+publicKeys[config.get('hostname')] = publicKey;
+
logger.debug("pre-seeded public key cache with key for " +
config.get('hostname'));
--
GitLab