applications/pass-desktop/src/tls.ts

   1 import { createHash, createPublicKey } from 'crypto';
   2 import logger from 'electron-log/main';
   3
   4 enum VerificationResult {
   5     Accept = 0,
   6     Reject = -2,
   7 }
   8
   9 const PROTON_CERT_PK_HASHES = [
  10     // proton.me certificate
  11     'CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=', // Current
  12     '35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=', // Hot backup
  13     'qYIukVc63DEITct8sFT7ebIq5qsWmuscaIKeJx+5J5A=', // Cold backup
  14 ];
  15
  16 const isProtonTlsCertificate = (...[key]: Parameters<typeof createPublicKey>): boolean => {
  17     const pubKey = createPublicKey(key).export({ type: 'spki', format: 'der' });
  18     const pubKeyHash = createHash('sha256').update(pubKey).digest('base64');
  19     return PROTON_CERT_PK_HASHES.includes(pubKeyHash);
  20 };
  21
  22 export const certificateVerifyProc = (request: Electron.Request, callback: (code: VerificationResult) => void) => {
  23     const {
  24         validatedCertificate: { data },
  25         verificationResult,
  26     } = request;
  27
  28     if (verificationResult === 'net::OK' && isProtonTlsCertificate(data)) return callback(VerificationResult.Accept);
  29
  30     logger.warn(`[tls] invalid certificate for ${request.hostname} (${verificationResult})`, data);
  31     return callback(VerificationResult.Reject);
  32 };