mirror of
https://github.com/clusterio/clusterio.git
synced 2026-11-12 07:04:52 +09:00
Hornwitser
dbe01c6c23
The jsonwebtoken accept strings as input for secrets which is nonsensical from a cryptographic standpoint as the algorithms all operate on byte sequences. Worse still, strings are encoded into bytes using UTF-8, which disallows certain sequences of bytes from appearing and potentially weakening the cryptography. For legacy reasons the master secret was encoded into base64 _and passed as a string to jsonwebtoken_. This further weakened the crypto as the bytes that can appear in base 64 is only 1/4 of the 256 possible values for bytes. This could significantly weaken the cryptographic strength of the tokens. I have known of this issue for quite some time but has put off actually fixing it for too long now. Since the master secret is already documented as being in base 64, decode it as base 64 and pass it as a byte Buffer to jsonwebtoken. This will ensure every byte value is possible in the byte sequence passed to the jsonwebtoken crypto. The impact of this change is unfortunately that all tokens will become invalid and will have to be reissued.
65 lines
2.1 KiB
JavaScript
65 lines
2.1 KiB
JavaScript
"use strict";
|
|
const assert = require("assert").strict;
|
|
const events = require("events");
|
|
const fs = require("fs-extra");
|
|
const jwt = require("jsonwebtoken");
|
|
|
|
const { TestControlConnector, TestControl, get, exec, url } = require("./index");
|
|
|
|
let token = jwt.sign({ aud: "user", user: "test" }, Buffer.from("TestSecretDoNotUse", "base64"));
|
|
|
|
describe("Integration of lib/link", function() {
|
|
let tlsCa;
|
|
let control;
|
|
let controlConnector;
|
|
before(async function() {
|
|
tlsCa = await fs.readFile("test/file/tls/cert.pem");
|
|
});
|
|
it("should emitt an error if authentication failed", async function() {
|
|
controlConnector = new TestControlConnector(url, 0.2, tlsCa);
|
|
controlConnector.token = "gibberish";
|
|
control = new TestControl(controlConnector);
|
|
await assert.rejects(
|
|
controlConnector.connect(),
|
|
new Error("Authentication failed: jwt malformed")
|
|
);
|
|
});
|
|
|
|
it("should connect with proper credentials", async function() {
|
|
controlConnector = new TestControlConnector(url, 0.2, tlsCa);
|
|
controlConnector.token = token;
|
|
control = new TestControl(controlConnector);
|
|
await controlConnector.connect();
|
|
});
|
|
|
|
it("should reconnect on connection lost", async function() {
|
|
controlConnector._socket.close(1008, "Test");
|
|
await events.once(controlConnector, "resume");
|
|
});
|
|
|
|
it("should reconnect on connection terminated", async function() {
|
|
controlConnector._socket.terminate();
|
|
await events.once(controlConnector, "resume");
|
|
});
|
|
|
|
it("should reconnect on connection heartbeat timeout", async function() {
|
|
controlConnector.stopHeartbeat();
|
|
await events.once(controlConnector, "resume");
|
|
});
|
|
|
|
it("should invalidate on reconnection with bad session token", async function() {
|
|
controlConnector._sessionToken = "blah";
|
|
controlConnector.stopHeartbeat();
|
|
await events.once(controlConnector, "invalidate");
|
|
await events.once(controlConnector, "connect");
|
|
});
|
|
|
|
it("should properly close connector if close is called during reconnect wait", async function() {
|
|
controlConnector._socket.close(1008, "Test");
|
|
controlConnector.once("drop", () => {
|
|
controlConnector.close();
|
|
});
|
|
await events.once(controlConnector, "close");
|
|
});
|
|
});
|