395 lines
17 KiB
PowerShell
395 lines
17 KiB
PowerShell
param(
|
|
[string]$Hostname = "poc.openwork.test",
|
|
[int]$HealthyPort = 8443,
|
|
[int]$BrokenPort = 9443,
|
|
[switch]$Cleanup
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$Marker = "OpenWork TLS Repro"
|
|
$ReproDir = Join-Path (Get-Location).Path "tls-repro"
|
|
$StatePath = Join-Path $ReproDir "state.txt"
|
|
$HostsMarker = "# OpenWork TLS repro"
|
|
$SslAppId = "{1f6c8f8b-6b57-4a0b-8a1c-8d7e3d8f0d31}"
|
|
|
|
function Write-Step {
|
|
param([string]$Message = "")
|
|
Write-Host $Message
|
|
}
|
|
|
|
function Assert-WindowsAdmin {
|
|
if ([System.Environment]::OSVersion.Platform -ne [System.PlatformID]::Win32NT) {
|
|
Write-Step "ERROR: This setup script is Windows-only because it uses New-SelfSignedCertificate, Cert:\LocalMachine, netsh, and HttpListener TLS bindings."
|
|
exit 1
|
|
}
|
|
|
|
try {
|
|
$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = New-Object System.Security.Principal.WindowsPrincipal -ArgumentList $identity
|
|
$isAdmin = $principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
if (-not $isAdmin) {
|
|
Write-Step "ERROR: Run this from an elevated PowerShell prompt (Run as Administrator)."
|
|
exit 1
|
|
}
|
|
}
|
|
catch {
|
|
Write-Step "ERROR: Could not verify administrator privileges. Run this from elevated Windows PowerShell."
|
|
Write-Step $_.Exception.Message
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
function Read-State {
|
|
$state = @{}
|
|
if (Test-Path -LiteralPath $StatePath) {
|
|
foreach ($line in (Get-Content -LiteralPath $StatePath)) {
|
|
if ($line -match "^([^=]+)=(.*)$") {
|
|
$state[$matches[1]] = $matches[2]
|
|
}
|
|
}
|
|
}
|
|
return $state
|
|
}
|
|
|
|
function Remove-SslBinding {
|
|
param([int]$Port)
|
|
|
|
try {
|
|
$ipPort = "0.0.0.0:{0}" -f $Port
|
|
$output = & netsh http delete sslcert ipport=$ipPort 2>&1
|
|
if ($LASTEXITCODE -eq 0) {
|
|
Write-Step ("Removed SSL binding {0}." -f $ipPort)
|
|
}
|
|
else {
|
|
Write-Step ("No removable SSL binding at {0} (netsh: {1})." -f $ipPort, (($output | Out-String).Trim()))
|
|
}
|
|
}
|
|
catch {
|
|
Write-Step ("WARN: Could not remove SSL binding for port {0}: {1}" -f $Port, $_.Exception.Message)
|
|
}
|
|
}
|
|
|
|
function Add-SslBinding {
|
|
param(
|
|
[int]$Port,
|
|
[string]$Thumbprint
|
|
)
|
|
|
|
Remove-SslBinding -Port $Port
|
|
$ipPort = "0.0.0.0:{0}" -f $Port
|
|
$output = & netsh http add sslcert ipport=$ipPort certhash=$Thumbprint appid=$SslAppId certstorename=MY 2>&1
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw ("netsh http add sslcert failed for {0}: {1}" -f $ipPort, (($output | Out-String).Trim()))
|
|
}
|
|
Write-Step ("Added SSL binding {0} -> {1}." -f $ipPort, $Thumbprint)
|
|
}
|
|
|
|
function Stop-ReproJobs {
|
|
try {
|
|
$jobs = Get-Job -Name "OpenWorkTlsRepro-*" -ErrorAction SilentlyContinue
|
|
foreach ($job in $jobs) {
|
|
Write-Step ("Stopping PowerShell job {0} (Id {1})." -f $job.Name, $job.Id)
|
|
Stop-Job -Job $job -ErrorAction SilentlyContinue
|
|
Remove-Job -Job $job -Force -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
catch {
|
|
Write-Step ("WARN: Could not stop repro jobs in this session: {0}" -f $_.Exception.Message)
|
|
}
|
|
}
|
|
|
|
function Remove-HostsEntries {
|
|
param([string[]]$Names)
|
|
|
|
$hostsPath = Join-Path $env:SystemRoot "System32\drivers\etc\hosts"
|
|
if (-not (Test-Path -LiteralPath $hostsPath)) {
|
|
Write-Step ("WARN: Hosts file not found at {0}." -f $hostsPath)
|
|
return
|
|
}
|
|
|
|
$lines = Get-Content -LiteralPath $hostsPath
|
|
$newLines = @()
|
|
$changed = $false
|
|
foreach ($line in $lines) {
|
|
$removeLine = $false
|
|
if ($line -match [regex]::Escape($HostsMarker)) {
|
|
$removeLine = $true
|
|
}
|
|
else {
|
|
foreach ($name in $Names) {
|
|
if (-not [string]::IsNullOrWhiteSpace($name)) {
|
|
$escapedName = [regex]::Escape($name)
|
|
if ($line -match ("^\s*127\.0\.0\.1\s+{0}(\s|$)" -f $escapedName)) {
|
|
$removeLine = $true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($removeLine) {
|
|
$changed = $true
|
|
}
|
|
else {
|
|
$newLines += $line
|
|
}
|
|
}
|
|
|
|
if ($changed) {
|
|
Set-Content -LiteralPath $hostsPath -Value $newLines -Encoding ASCII
|
|
Write-Step "Removed repro hosts-file entries."
|
|
}
|
|
else {
|
|
Write-Step "No repro hosts-file entries found."
|
|
}
|
|
}
|
|
|
|
function Add-HostsEntry {
|
|
param([string]$Name)
|
|
|
|
$hostsPath = Join-Path $env:SystemRoot "System32\drivers\etc\hosts"
|
|
$escapedName = [regex]::Escape($Name)
|
|
$existingLines = @()
|
|
if (Test-Path -LiteralPath $hostsPath) {
|
|
$existingLines = Get-Content -LiteralPath $hostsPath
|
|
}
|
|
|
|
foreach ($line in $existingLines) {
|
|
if ($line -match ("^\s*127\.0\.0\.1\s+{0}(\s|$)" -f $escapedName)) {
|
|
Write-Step ("Hosts file already maps 127.0.0.1 to {0}." -f $Name)
|
|
return
|
|
}
|
|
if ($line -match ("^\s*\S+\s+{0}(\s|$)" -f $escapedName)) {
|
|
Write-Step ("WARN: Hosts file already mentions {0}: {1}" -f $Name, $line)
|
|
}
|
|
}
|
|
|
|
Add-Content -LiteralPath $hostsPath -Value ("127.0.0.1 {0} {1}" -f $Name, $HostsMarker) -Encoding ASCII
|
|
Write-Step ("Added hosts-file entry: 127.0.0.1 {0}." -f $Name)
|
|
}
|
|
|
|
function Remove-CertificatesByThumbprint {
|
|
param([string[]]$Thumbprints)
|
|
|
|
$stores = @("Cert:\LocalMachine\My", "Cert:\LocalMachine\Root", "Cert:\LocalMachine\CA", "Cert:\CurrentUser\My")
|
|
foreach ($thumbprint in ($Thumbprints | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique)) {
|
|
foreach ($store in $stores) {
|
|
try {
|
|
$matches = Get-ChildItem -LiteralPath $store -ErrorAction SilentlyContinue | Where-Object { $_.Thumbprint -eq $thumbprint }
|
|
foreach ($cert in $matches) {
|
|
Write-Step ("Removing certificate thumbprint {0} from {1}." -f $thumbprint, $store)
|
|
Remove-Item -LiteralPath $cert.PSPath -Force -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
catch {
|
|
Write-Step ("WARN: Could not scan {0}: {1}" -f $store, $_.Exception.Message)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
function Remove-CertificatesByMarker {
|
|
$stores = @("Cert:\LocalMachine\My", "Cert:\LocalMachine\Root", "Cert:\LocalMachine\CA", "Cert:\CurrentUser\My")
|
|
foreach ($store in $stores) {
|
|
try {
|
|
$matches = Get-ChildItem -LiteralPath $store -ErrorAction SilentlyContinue | Where-Object { $_.Subject -like ("*{0}*" -f $Marker) }
|
|
foreach ($cert in $matches) {
|
|
Write-Step ("Removing marked certificate {0} from {1}." -f $cert.Thumbprint, $store)
|
|
Remove-Item -LiteralPath $cert.PSPath -Force -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
catch {
|
|
Write-Step ("WARN: Could not remove marked certs from {0}: {1}" -f $store, $_.Exception.Message)
|
|
}
|
|
}
|
|
}
|
|
|
|
function Invoke-Cleanup {
|
|
param([switch]$Quiet)
|
|
|
|
if (-not $Quiet) {
|
|
Write-Step "Cleaning OpenWork TLS repro artifacts..."
|
|
}
|
|
|
|
$state = Read-State
|
|
$ports = @($HealthyPort, $BrokenPort)
|
|
if ($state.ContainsKey("HealthyPort")) { $ports += [int]$state["HealthyPort"] }
|
|
if ($state.ContainsKey("BrokenPort")) { $ports += [int]$state["BrokenPort"] }
|
|
foreach ($port in ($ports | Select-Object -Unique)) {
|
|
Remove-SslBinding -Port $port
|
|
}
|
|
|
|
Stop-ReproJobs
|
|
|
|
$names = @($Hostname)
|
|
if ($state.ContainsKey("Hostname")) { $names += $state["Hostname"] }
|
|
Remove-HostsEntries -Names ($names | Select-Object -Unique)
|
|
|
|
$thumbprints = @()
|
|
foreach ($key in $state.Keys) {
|
|
if ($key -match "Thumbprint$") {
|
|
$thumbprints += $state[$key]
|
|
}
|
|
}
|
|
Remove-CertificatesByThumbprint -Thumbprints $thumbprints
|
|
Remove-CertificatesByMarker
|
|
|
|
if (Test-Path -LiteralPath $ReproDir) {
|
|
Remove-Item -LiteralPath $ReproDir -Recurse -Force
|
|
Write-Step ("Removed {0}." -f $ReproDir)
|
|
}
|
|
}
|
|
|
|
function Start-ReproListenerJob {
|
|
param(
|
|
[int]$Port,
|
|
[string]$Label
|
|
)
|
|
|
|
$jobName = "OpenWorkTlsRepro-{0}" -f $Port
|
|
$existing = Get-Job -Name $jobName -ErrorAction SilentlyContinue
|
|
foreach ($job in $existing) {
|
|
Stop-Job -Job $job -ErrorAction SilentlyContinue
|
|
Remove-Job -Job $job -Force -ErrorAction SilentlyContinue
|
|
}
|
|
|
|
# Windows-only runtime path. This section is parse-checked from macOS but must be exercised in a Daytona Windows sandbox.
|
|
# HttpListener delegates TLS to HTTP.sys/Schannel. The healthy port can send the intermediate because it is installed
|
|
# in LocalMachine\CA; the broken port binds a leaf whose intermediate is intentionally removed from local stores.
|
|
$job = Start-Job -Name $jobName -ArgumentList $Port, $Label -ScriptBlock {
|
|
param([int]$Port, [string]$Label)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$listener = New-Object System.Net.HttpListener
|
|
$listener.Prefixes.Add(("https://+:{0}/" -f $Port))
|
|
$listener.Start()
|
|
try {
|
|
while ($true) {
|
|
$context = $listener.GetContext()
|
|
$payload = '{"workspaces":[]}'
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
|
|
$context.Response.StatusCode = 200
|
|
$context.Response.ContentType = "application/json"
|
|
$context.Response.Headers.Add("X-OpenWork-TLS-Repro", $Label)
|
|
$context.Response.ContentLength64 = $bytes.Length
|
|
$context.Response.OutputStream.Write($bytes, 0, $bytes.Length)
|
|
$context.Response.OutputStream.Close()
|
|
}
|
|
}
|
|
finally {
|
|
$listener.Stop()
|
|
$listener.Close()
|
|
}
|
|
}
|
|
|
|
Start-Sleep -Milliseconds 1000
|
|
$job = Get-Job -Id $job.Id
|
|
if ($job.State -ne "Running") {
|
|
$details = Receive-Job -Job $job -Keep -ErrorAction SilentlyContinue | Out-String
|
|
throw ("Listener job {0} did not stay running. State={1}. Output={2}" -f $jobName, $job.State, $details)
|
|
}
|
|
|
|
Write-Step ("Started HTTPS listener job {0} (Id {1})." -f $job.Name, $job.Id)
|
|
}
|
|
|
|
Assert-WindowsAdmin
|
|
|
|
if ($Cleanup) {
|
|
Invoke-Cleanup
|
|
exit 0
|
|
}
|
|
|
|
Write-Step "OpenWork TLS repro setup"
|
|
Write-Step "Strategy: HTTP.sys/HttpListener with netsh sslcert bindings. Healthy uses root + installed intermediate; broken uses a different intermediate that is removed before serving."
|
|
Write-Step "Risk: Windows chain caching can occasionally make the broken case validate until cache/session state is cleared; rerun -Cleanup or use a fresh VM if that happens."
|
|
Write-Step ""
|
|
|
|
Invoke-Cleanup -Quiet
|
|
New-Item -ItemType Directory -Path $ReproDir -Force | Out-Null
|
|
|
|
$notAfter = (Get-Date).AddYears(1)
|
|
$rootSubject = "CN=OpenWork TLS Repro Root CA, O=$Marker"
|
|
$healthyIntermediateSubject = "CN=OpenWork TLS Repro Healthy Intermediate CA, O=$Marker"
|
|
$brokenIntermediateSubject = "CN=OpenWork TLS Repro Broken Intermediate CA, O=$Marker"
|
|
$healthyLeafSubject = "CN=$Hostname, O=$Marker"
|
|
$brokenLeafSubject = "CN=$Hostname, O=$Marker"
|
|
$leafExtensions = @(
|
|
"2.5.29.17={text}DNS=$Hostname",
|
|
"2.5.29.19={critical}{text}ca=0",
|
|
"2.5.29.37={text}1.3.6.1.5.5.7.3.1"
|
|
)
|
|
|
|
Write-Step "Generating root, intermediates, and leaf certificates with New-SelfSignedCertificate..."
|
|
$root = New-SelfSignedCertificate -Type Custom -Subject $rootSubject -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable -KeyUsage CertSign, CRLSign, DigitalSignature -TextExtension @("2.5.29.19={critical}{text}ca=1&pathlength=2") -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter $notAfter
|
|
$healthyIntermediate = New-SelfSignedCertificate -Type Custom -Subject $healthyIntermediateSubject -Signer $root -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable -KeyUsage CertSign, CRLSign, DigitalSignature -TextExtension @("2.5.29.19={critical}{text}ca=1&pathlength=0") -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter $notAfter
|
|
$brokenIntermediate = New-SelfSignedCertificate -Type Custom -Subject $brokenIntermediateSubject -Signer $root -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable -KeyUsage CertSign, CRLSign, DigitalSignature -TextExtension @("2.5.29.19={critical}{text}ca=1&pathlength=0") -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter $notAfter
|
|
$healthyLeaf = New-SelfSignedCertificate -Type Custom -Subject $healthyLeafSubject -Signer $healthyIntermediate -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable -KeySpec KeyExchange -KeyUsage DigitalSignature, KeyEncipherment -TextExtension $leafExtensions -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter $notAfter
|
|
$brokenLeaf = New-SelfSignedCertificate -Type Custom -Subject $brokenLeafSubject -Signer $brokenIntermediate -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable -KeySpec KeyExchange -KeyUsage DigitalSignature, KeyEncipherment -TextExtension $leafExtensions -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter $notAfter
|
|
|
|
$rootPath = Join-Path $ReproDir "root.cer"
|
|
$healthyIntermediatePath = Join-Path $ReproDir "healthy-intermediate.cer"
|
|
Export-Certificate -Cert $root -FilePath $rootPath | Out-Null
|
|
Export-Certificate -Cert $healthyIntermediate -FilePath $healthyIntermediatePath | Out-Null
|
|
Import-Certificate -FilePath $rootPath -CertStoreLocation "Cert:\LocalMachine\Root" | Out-Null
|
|
Import-Certificate -FilePath $healthyIntermediatePath -CertStoreLocation "Cert:\LocalMachine\CA" | Out-Null
|
|
Write-Step ("Installed ONLY the repro root into Cert:\LocalMachine\Root: {0}" -f $root.Thumbprint)
|
|
Write-Step ("Installed healthy intermediate into Cert:\LocalMachine\CA so Schannel can build/send that chain: {0}" -f $healthyIntermediate.Thumbprint)
|
|
|
|
# The broken leaf was signed by this intermediate, then the intermediate is removed from local stores.
|
|
# If a Windows build caches it anyway, the broken endpoint may validate until cache/session state is reset.
|
|
Remove-CertificatesByThumbprint -Thumbprints @($brokenIntermediate.Thumbprint)
|
|
Write-Step ("Removed broken intermediate from local stores: {0}" -f $brokenIntermediate.Thumbprint)
|
|
|
|
$stateLines = @(
|
|
"Hostname=$Hostname",
|
|
"HealthyPort=$HealthyPort",
|
|
"BrokenPort=$BrokenPort",
|
|
"RootThumbprint=$($root.Thumbprint)",
|
|
"HealthyIntermediateThumbprint=$($healthyIntermediate.Thumbprint)",
|
|
"BrokenIntermediateThumbprint=$($brokenIntermediate.Thumbprint)",
|
|
"HealthyLeafThumbprint=$($healthyLeaf.Thumbprint)",
|
|
"BrokenLeafThumbprint=$($brokenLeaf.Thumbprint)"
|
|
)
|
|
Set-Content -LiteralPath $StatePath -Value $stateLines -Encoding ASCII
|
|
|
|
Add-HostsEntry -Name $Hostname
|
|
Add-SslBinding -Port $HealthyPort -Thumbprint $healthyLeaf.Thumbprint
|
|
Add-SslBinding -Port $BrokenPort -Thumbprint $brokenLeaf.Thumbprint
|
|
Start-ReproListenerJob -Port $HealthyPort -Label "healthy-chain"
|
|
Start-ReproListenerJob -Port $BrokenPort -Label "broken-missing-intermediate"
|
|
|
|
$healthyUrl = "https://{0}:{1}/" -f $Hostname, $HealthyPort
|
|
$brokenUrl = "https://{0}:{1}/" -f $Hostname, $BrokenPort
|
|
$rootPathForNode = (Resolve-Path -LiteralPath $rootPath).Path
|
|
|
|
Write-Step ""
|
|
Write-Step "Setup complete. Keep this PowerShell window open so the background jobs keep serving."
|
|
Write-Step ""
|
|
Write-Step "Test matrix (paste each result under the command that produced it):"
|
|
Write-Step ("1. curl healthy (expect HTTP 200 with {0}):" -f '{"workspaces":[]}')
|
|
Write-Step (" curl.exe -v {0}" -f $healthyUrl)
|
|
Write-Step "2. curl broken (expect certificate/chain failure on a fresh VM; if it succeeds, Windows found a cached intermediate):"
|
|
Write-Step (" curl.exe -v {0}" -f $brokenUrl)
|
|
Write-Step "3. Doctor against both local endpoints:"
|
|
Write-Step (" powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\support\openwork-doctor.ps1 -WebUrl {0} -ApiUrl {1} -ExpectedIssuerMatch `"OpenWork TLS Repro`"" -f $healthyUrl, $brokenUrl)
|
|
|
|
$nodeCommand = Get-Command node -ErrorAction SilentlyContinue
|
|
if ($nodeCommand -ne $null) {
|
|
$nodeHealthy = "node -e `"fetch('$healthyUrl').then(r=>r.text()).then(console.log).catch(e=>{ console.error(e); process.exit(1) })`""
|
|
$nodeBroken = "node -e `"fetch('$brokenUrl').then(r=>r.text()).then(console.log).catch(e=>{ console.error(e); process.exit(1) })`""
|
|
Write-Step "4. Node fetch without extra CA (often fails because stock Node may not use Windows LocalMachine Root):"
|
|
Write-Step (" {0}" -f $nodeHealthy)
|
|
Write-Step (" {0}" -f $nodeBroken)
|
|
Write-Step "5. Node fetch with the repro root trusted through NODE_EXTRA_CA_CERTS (healthy should OK; broken should fail):"
|
|
Write-Step (" `$env:NODE_EXTRA_CA_CERTS = `"{0}`"" -f $rootPathForNode)
|
|
Write-Step (" {0}" -f $nodeHealthy)
|
|
Write-Step (" {0}" -f $nodeBroken)
|
|
}
|
|
else {
|
|
Write-Step "4. Node fetch: node.exe was not found on PATH. Install Node or skip this part."
|
|
Write-Step " Expected when Node is available: healthy OK only with NODE_EXTRA_CA_CERTS/system CA integration; broken FAIL."
|
|
}
|
|
|
|
Write-Step ""
|
|
Write-Step "Cleanup when finished:"
|
|
Write-Step " powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\support\setup-openwork-tls-repro.ps1 -Cleanup"
|