Fix 1148 add native node https support #1202

Wikinaut · 2012-11-23T20:22:02Z

Fix for issue #1148.

added the possibility to run the whole Etherpad-lite on native Node via SSL ( https:// ) protocol.
no further Apache or Nginx proxy server required
default = no SSL ( http:// protocol, unsecure password transmission)
added info message when the server starts whether SSL is disabled, or enabled and which server key file is used

Wikinaut · 2012-11-23T22:13:28Z

The patch is "compatible". I mean, when not changing anything, the EPL runs in non-SSL mode as before as requested by John.

JohnMcLear · 2012-11-24T00:47:50Z

Looks good to me, needs further testing , good job:)

Wikinaut · 2012-11-24T00:51:36Z

Yep. Everything works with https:// ->>> except the Timeslider. Can you test that, please ? It now returns a BLANK page. Perhaps we are close to find the reason now....

Timeslider mega problem see #1077

JohnMcLear · 2012-11-24T17:23:47Z

Just thinking how we handle passphrases?

JohnMcLear · 2012-11-24T17:26:03Z

"key" : "c:\temp\wiki\etherpad-lite\ep.key", as a path doesnt work
changed to
"key" : "c:/temp/wiki/etherpad-lite/ep.key",
just needs documenting

JohnMcLear · 2012-11-24T17:26:43Z

Generating the keys with puttygen doesn't work, can we document the correct steps in puttygen to generate good to use ssl keys?

JohnMcLear · 2012-11-24T17:27:14Z

You need useful debug messages if a user puts in a bad path/key

[2012-11-24 17:24:36.284] [INFO] console - SSL -- server key file: c:   empwikietherpad-liteep.key
[2012-11-24 17:24:36.285] [INFO] console - SSL -- Certificate Authority's certificate file: c:  empwikietherpad-liteep.crt

fs.js:338
  return binding.open(pathModule._makeLong(path), stringToFlags(flags), mode);
                 ^
Error: ENOENT, no such file or directory 'c:\temp\wiki\etherpad-lite\   empwikietherpad-liteep.key'
    at Object.fs.openSync (fs.js:338:18)
    at Object.fs.openSync (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node_modules\npm\node_modules\graceful-fs\graceful-fs.js:68:26)
    at Object.fs.openSync (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node_modules\graceful-fs\graceful-fs.js:74:27)
    at Object.fs.openSync (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node_modules\npm-registry-client\node_modules\graceful-fs\graceful-fs.js:68:26)
    at Object.fs.readFileSync (fs.js:182:15)
    at Object.exports.restartServer (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node\hooks\express.js:60:15)
    at Object.exports.createServer [as hook_fn] (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node\hooks\express.js:32:11)
    at normalizedhook (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\static\js\pluginfw\hooks.js:15:27)
    at hookCallWrapper (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\static\js\pluginfw\hooks.js:21:14)
    at exports.callAll (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\static\js\pluginfw\hooks.js:75:12)

C:\temp\wiki\etherpad-lite>nano settings.jso

C:\temp\wiki\etherpad-lite>start.bat

C:\temp\wiki\etherpad-lite>node node_modules\ep_etherpad-lite\node\server.js
[2012-11-24 17:25:23.638] [WARN] console - DirtyDB is used. This is fine for testing but not recommended for production.
[2012-11-24 17:25:24.249] [INFO] console - Installed plugins: ep_etherpad-lite
[2012-11-24 17:25:24.281] [INFO] console - Your Etherpad Lite git version is 43980ff
[2012-11-24 17:25:24.282] [INFO] console - Report bugs at https://github.com/ether/etherpad-lite/issues
[2012-11-24 17:25:24.287] [INFO] console - SSL -- enabled
[2012-11-24 17:25:24.288] [INFO] console - SSL -- server key file: c:/temp/wiki/etherpad-lite/ep.key
[2012-11-24 17:25:24.289] [INFO] console - SSL -- Certificate Authority's certificate file: c:/temp/wiki/etherpad-lite/ep.crt

crypto.js:84
      c.context.setKey(options.key);
                ^
Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
    at Object.exports.createCredentials (crypto.js:84:17)
    at Server (tls.js:1031:28)
    at new Server (https.js:33:14)
    at Object.exports.createServer (https.js:48:10)
    at Object.exports.restartServer (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node\hooks\express.js:65:20)
    at Object.exports.createServer [as hook_fn] (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\node\hooks\express.js:32:11)
    at normalizedhook (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\static\js\pluginfw\hooks.js:15:27)
    at hookCallWrapper (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\static\js\pluginfw\hooks.js:21:14)
    at exports.callAll (C:\temp\wiki\etherpad-lite\node_modules\ep_etherpad-lite\static\js\pluginfw\hooks.js:75:12)
    at Array.map (native)

C:\temp\wiki\etherpad-lite>

is not good enough

Wikinaut · 2012-11-24T17:27:49Z

ok, will do so !

JohnMcLear · 2012-11-24T17:28:04Z

I can't test timeslider until we have good docs on how to deploy so this one is back at ya @Wikinaut, let me know once you are good for me to continue

Wikinaut · 2012-11-24T17:29:47Z

PuttyGen and OpenSSl are not 100% compatible for generating server keys. This is a well known problem and has nothing to do with the present patch. Give me time... to document

Wikinaut · 2012-11-24T17:31:48Z

@johnyma22 you wrote I can't test timeslider until we have good docs...

As mentioned 1000 times, p l e a s e visit your own pad http://beta.primarypad.com/p/test/timeslider where you will certainly notice, that it does not work as expected.

Wikinaut · 2012-11-24T17:39:31Z

@johnyma22

OpenSSH under Linux cannot read ppk files generated by PuTTY under Windows....

Use these instructions to generate and sign server keys, one of the best descriptions on the web

Creating Certificate Authorities and self-signed SSL certificates

http://web.archive.org/web/20110704035103/http://www.tc.umn.edu/~brams006/selfsign.html

I just contacted the author for his expressed permission to re-use his description.

Wikinaut · 2012-11-24T17:44:20Z

@johnyma22 > You need useful debug messages if a user puts in a bad path/key

Not my task, SSL works now for me, and I presented the fine basic code in my pull request; the fine tuning of error messages can be done by others, respectfully stated(*). Running an APACHE2 with wrong keys, you will find also strange misleading error messages - which nobody of the Apache foundation has fixed in the last 20 years.

(*) I am not yet in a position to being able to supply a perfect code for error conditions like the one you have encountered (lack of knowledge, sorry). If you can add some error robustness to the crypto.js calls, I will very much appreciate this.

JohnMcLear · 2012-11-24T17:50:37Z

@Wikinaut As mentioned 1000 times you still haven't provided steps to replicate the bug. You just keep providing a URL that we know is broken. Plus this has nothing to do with this pull request so let's keep things on topic.

JohnMcLear · 2012-11-24T17:51:47Z

@Wikinaut okay bump me when docs are ready :) thanks.

JohnMcLear · 2012-11-24T17:53:14Z

Also RE useful debug this wont be merged until it's clear to users how to set this up, even if the debug help is provided in a wiki "how to setup native SSL support" or whatever you create that would be okay enough to see it merged. It's really important that people can get past any barriers that SSL may introduce :)

Cheers

Wikinaut · 2012-11-24T19:50:47Z

@johnyma22 Regarding this

"key" : "c:\temp\wiki\etherpad-lite\ep.key", as a path doesnt work
changed to
"key" : "c:/temp/wiki/etherpad-lite/ep.key",
just needs documenting

.... isn't that an issue to be reported to the people responsible for "fs.readFileSync( filename )", which apparently does ignore the operation-system specific path separators?

I thought, that filenames and paths are handled transparently for the user, system independently. Will investigate, why it isn't.

Wikinaut · 2012-11-24T19:54:29Z

@johnyma22

Also RE useful debug this wont be merged until it's clear to users how to set this up, even if the debug help is provided in a wiki "how to setup native SSL support" or whatever you create that would be okay enough to see it merged. It's really important that people can get past any barriers that SSL may introduce :)

John, SSL is web standard. Every admin knows. Why should we duplicate information which is available on the net, especially as it is NOT EPL default, as requested by you. Honestly, to explain here in the EPL context, how SSL works and how keys to be generated goes beyond the scope of my work and litters the EPL pages with unneeded information.

But to please you, I will set up a new "ether" wiki page

joker-x · 2012-11-24T20:17:06Z

How to configure nginx or varnish is available on the net too, but it is usefull collect all relative configuration in the wiki. I think it is the same case. Often, features are not used because the newbie user not found good documentation. And this is a pity.

👍 new wiki page!

Wikinaut · 2012-11-24T20:26:11Z

https://github.com/ether/etherpad-lite/wiki/Providing-encrypted-web-access-to-Etherpad-Lite-using-SSL-certificates-(HTTPS:--) as requested

JohnMcLear · 2012-11-24T21:10:51Z

openssl.exe is available by default in Windows?

JohnMcLear · 2012-11-24T21:15:59Z

The wiki page needs a big warning saying "DO NOT COPY/PASTE THESE STEPS AS IT WONT WORK"

JohnMcLear · 2012-11-24T21:19:19Z

@Wikinaut Works great and timeslider is fine -- Good job :) Once my final concerns have been addressed this will be good to merge. Today or tomorrow I expect

Wikinaut · 2012-11-24T21:59:29Z

I just want to add this here:

there may be problems coming up when a plugin reads foreign http: resources in the context of the https secured pad
I observed this effect just right now with the ep_tables plugin
The browser then changes the "lock" symbol to "unlock".

I inspected the connection and the generated page code. The problem stems from the fact that ep_tables fetches via http these resources

<link rel='stylesheet' href='http://yui.yahooapis.com/2.9.0/build/fonts/fonts-min.css' type='text/css' />   
<link rel='stylesheet' href='http://yui.yahooapis.com/2.9.0/build/slider/assets/skins/sam/slider.css' type='text/css' />    
...
<link rel='stylesheet' href='http://yui.yahooapis.com/2.9.0/build/colorpicker/assets/skins/sam/colorpicker.css' type='text/css' />

I my view this currently should not prevent you to pull my current patch.

(updated)

Wikinaut · 2012-11-24T22:14:55Z

As consequence from the previous comment,

a secure EPL set up demands that also all required resources and frameworks come via https.

disy-mk · 2012-11-24T22:17:28Z

there may be problems coming up when a plugin breaks out of the iframe and uses a http:// instead of https:// connection.
I observed this effect just right now with the ep_tables plugin https://github.com/clkao/ep_tables
The browser then changes the "lock" symbol to "unlock".

Also saw that with ep_sketchspace; (was using EPL behind stunnel/nginx-combo to have "working" SSL)

Wikinaut · 2012-11-24T22:43:42Z

I could fix the problem !

Solution is: use protocol-independent urls "//" everywhere

MediaWiki has went to this in the last year, and all urls have been replaced by "//". The procedure is explained for example explained here http://stackoverflow.com/a/550164 "Is it valid to replace http:// with // in a script src=“http://…”?"

[updated]
removed the link to proof of concept

joker-x · 2012-11-24T22:44:10Z

A good trick to solve this problem is let the navigator choose proper protocol. For example, to load jquery from google CDN you can use:

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js"></script>

In SSL conection the navigator go to https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js or a standar conection to http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Wikinaut · 2012-11-24T22:44:38Z

mid-air collision !
I just posted THE solution.

joker-x · 2012-11-24T22:44:48Z

we are sincronized @Wikinaut :)

Wikinaut · 2012-11-24T22:45:47Z

@joker-x thanks. I also found this, and documented it, and added as a proof of concept my recent fork of ep_tables where I successfully applied the protocol independent url method. ty

Wikinaut · 2012-11-24T22:46:40Z

[updated]
removed the link to proof of concept

joker-x · 2012-11-24T22:49:45Z

using these protocol independent urls we can remove a few javascript check protocol lines :D

Wikinaut · 2012-11-24T23:20:56Z

I was right - but wrong with my proof of concept, because the yahoo server does not deliver content when requested via https:// .

Important

Of course keep in mind, that the protocol-independent url only works, if the resource servers actually deliver their contents over http:// and also over https:// ,

Wikinaut · 2012-11-25T00:05:25Z

I can now officially confirm, that "it" works.

"it" means:

when copying and unzipping http://yuilibrary.com/downloads/yui2/yui_2.9.0.zip to a server which delivers the stuff via https: (I used a non-Node server, running Apache), the protocol independent urls in my ep_tables fork https://github.com/Wikinaut/ep_tables/commit/c65c05924cbac89aa06e7ccbd2f92e76e2708a43 do work, and the ep_tables plugin in my SSL-EPL does work.

JohnMcLear · 2012-11-25T00:24:45Z

/me is confused why we need yui, am I missing something?

Wikinaut · 2012-11-25T00:29:53Z

@johnyma22 we do NOT need it.

ep_tables needs it and loads it. I discovered the "break out SSL" when having ep_tables activated. Now everything is clear and safe. Let me know if you need more details (I wanted to be short)

I installed locally you ONLY for the final test.

Wikinaut · 2012-11-25T00:31:02Z

I installed yui locally only for my test. Everything is clear. You can "pull"

…-support Fix 1148 add native node https support

Wikinaut · 2012-11-25T00:39:50Z

may be a small step for epl but a giant leap for mankind. Very kind. ty

Wikinaut added 3 commits November 22, 2012 10:12

initial https version fix #1148

eed6b75

Ip => IP typo fix; +comment for SSL

e8bca8e

chg server.key to epl-server.key

43980ff

Wikinaut mentioned this pull request Nov 24, 2012

General proposal for the developer guidelines: use protocol independent urls "//" #1212

Closed

JohnMcLear added a commit that referenced this pull request Nov 25, 2012

Merge pull request #1202 from Wikinaut/fix-1148-add-native-node-https…

fdf0b1a

…-support Fix 1148 add native node https support

JohnMcLear merged commit fdf0b1a into ether:develop Nov 25, 2012

Fix 1148 add native node https support #1202

Fix 1148 add native node https support #1202

Conversation

Wikinaut commented Nov 23, 2012

Wikinaut commented Nov 23, 2012

JohnMcLear commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Use these instructions to generate and sign server keys, one of the best descriptions on the web

Creating Certificate Authorities and self-signed SSL certificates

Wikinaut commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

joker-x commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

JohnMcLear commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

a secure EPL set up demands that also all required resources and frameworks come via https.

disy-mk commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

I could fix the problem !

Solution is: use protocol-independent urls "//" everywhere

joker-x commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

joker-x commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

joker-x commented Nov 24, 2012

Wikinaut commented Nov 24, 2012

Important

Wikinaut commented Nov 25, 2012

JohnMcLear commented Nov 25, 2012

Wikinaut commented Nov 25, 2012

Wikinaut commented Nov 25, 2012

Wikinaut commented Nov 25, 2012