greenlock-express.js/https-middleware.js

"use strict";

var SanitizeHost = module.exports;
var HttpMiddleware = require("./http-middleware.js");

SanitizeHost.create = function(gl, app) {
    return function(req, res, next) {
        function realNext() {
            if ("function" === typeof app) {
                app(req, res);
            } else if ("function" === typeof next) {
                next();
            } else {
                res.statusCode = 500;
                res.end("Error: no middleware assigned");
            }
        }

        var hostname = HttpMiddleware.getHostname(req);
        // Replace the hostname, and get the safe version
        var safehost = HttpMiddleware.sanitizeHostname(req);

        // if no hostname, move along
        if (!hostname) {
            realNext();
            return;
        }

        // if there were unallowed characters, complain
        if (safehost.length !== hostname.length) {
            res.statusCode = 400;
            res.end("Malformed HTTP Header: 'Host: " + hostname + "'");
            return;
        }

        // Note: This sanitize function is also called on plain sockets, which don't need Domain Fronting checks
        if (req.socket.encrypted) {
            if (req.socket && "string" === typeof req.socket.servername) {
                // Workaround for https://github.com/nodejs/node/issues/22389
                if (!SanitizeHost._checkServername(safehost, req.socket)) {
                    res.statusCode = 400;
                    res.setHeader("Content-Type", "text/html; charset=utf-8");
                    res.end(
                        "<h1>Domain Fronting Error</h1>" +
                            "<p>This connection was secured using TLS/SSL for '" +
                            (req.socket.servername || "").toLowerCase() +
                            "'</p>" +
                            "<p>The HTTP request specified 'Host: " +
                            safehost +
                            "', which is (obviously) different.</p>" +
                            "<p>Because this looks like a domain fronting attack, the connection has been terminated.</p>"
                    );
                    return;
                }
            }
            /*
      else if (safehost && !gl._skip_fronting_check) {

				// We used to print a log message here, but it turns out that it's
				// really common for IoT devices to not use SNI (as well as many bots
				// and such).
				// It was common for the log message to pop up as the first request
				// to the server, and that was confusing. So instead now we do nothing.

				//console.warn("no string for req.socket.servername," + " skipping fronting check for '" + safehost + "'");
				//gl._skip_fronting_check = true;
			}
      */
        }

        // carry on
        realNext();
    };
};

var warnDomainFronting = true;
var warnUnexpectedError = true;
SanitizeHost._checkServername = function(safeHost, tlsSocket) {
    var servername = (tlsSocket.servername || "").toLowerCase();

    // acceptable: older IoT devices may lack SNI support
    if (!servername) {
        return true;
    }
    // acceptable: odd... but acceptable
    if (!safeHost) {
        return true;
    }
    if (safeHost === servername) {
        return true;
    }

    if ("function" !== typeof tlsSocket.getCertificate) {
        // domain fronting attacks allowed
        if (warnDomainFronting) {
            // https://github.com/nodejs/node/issues/24095
            console.warn(
                "Warning: node " +
                    process.version +
                    " is vulnerable to domain fronting attacks. Please use node v11.2.0 or greater."
            );
            warnDomainFronting = false;
        }
        return true;
    }

    // connection established with servername and session is re-used for allowed name
    // See https://github.com/nodejs/node/issues/24095
    var cert = tlsSocket.getCertificate();
    try {
        // TODO optimize / cache?
        // *should* always have a string, right?
        // *should* always be lowercase already, right?
        //console.log(safeHost, cert.subject.CN, cert.subjectaltname);
        var isSubject = (cert.subject.CN || "").toLowerCase() === safeHost;
        if (isSubject) {
            return true;
        }

        var dnsnames = (cert.subjectaltname || "").split(/,\s+/);
        var inSanList = dnsnames.some(function(name) {
            // always prefixed with "DNS:"
            return safeHost === name.slice(4).toLowerCase();
        });

        if (inSanList) {
            return true;
        }
    } catch (e) {
        // not sure what else to do in this situation...
        if (warnUnexpectedError) {
            console.warn("Warning: encoutered error while performing domain fronting check: " + e.message);
            warnUnexpectedError = false;
        }
        return true;
    }

    return false;
};