feat(ssl): add hardened HTTPS agent with OCSP mixed policy (failHard=…

package.json

@@ -94,6 +94,7 @@
         "feed": "^4.2.2",
         "form-data": "~4.0.0",
         "gamedig": "^4.2.0",
+        "hardened-https-agent": "~1.5.0",
         "html-escaper": "^3.0.3",
         "http-cookie-agent": "~5.0.4",
         "http-graceful-shutdown": "~3.1.7",

server/model/monitor.js

@@ -28,6 +28,9 @@ const { CookieJar } = require("tough-cookie");
 const { HttpsCookieAgent } = require("http-cookie-agent/http");
 const https = require("https");
 const http = require("http");
+const { createCookieAgent } = require("http-cookie-agent/http");
+const { HardenedHttpsAgent, useNodeDefaultCaBundle } = require("hardened-https-agent");
+const { kumaBindableLogSink } = require("../utils/kuma-bindable-log-sink");
 
 const rootCertificates = rootCertificatesFingerprints();
 
@@ -437,6 +440,12 @@ class Monitor extends BeanModel {
                         agentFamily = 6;
                     }
 
+                    const httpAgentOptions = {
+                        maxCachedSessions: 0,
+                        autoSelectFamily: true,
+                        ...(agentFamily ? { family: agentFamily } : {})
+                    };
+
                     const httpsAgentOptions = {
                         maxCachedSessions: 0, // Use Custom agent to disable session reuse (https://github.com/nodejs/node/issues/3940)
                         rejectUnauthorized: !this.getIgnoreTls(),
@@ -445,10 +454,20 @@ class Monitor extends BeanModel {
                         ...(agentFamily ? { family: agentFamily } : {})
                     };
 
-                    const httpAgentOptions = {
-                        maxCachedSessions: 0,
-                        autoSelectFamily: true,
-                        ...(agentFamily ? { family: agentFamily } : {})
+                    const hardenedHttpsValidationKitOptions = {
+                        ocspPolicy: {
+                            mode: "mixed",
+                            failHard: false,
+                        },
+                        loggerOptions: {
+                            level: "debug",
+                            template: "{message}",
+                            sink: kumaBindableLogSink,
+                        }
+                    };
+                    const hardenedHttpsAgentOptions = {
+                        ca: useNodeDefaultCaBundle(),
+                        ...hardenedHttpsValidationKitOptions,
                     };
 
                     log.debug("monitor", `[${this.name}] Prepare Options for axios`);
@@ -529,7 +548,15 @@ class Monitor extends BeanModel {
                             ...httpsAgentOptions,
                             cookies: { jar }
                         };
-                        options.httpsAgent = new HttpsCookieAgent(httpsCookieAgentOptions);
+
+                        // Use hardened agent for HTTPS when TLS errors are not ignored
+                        if (!this.getIgnoreTls()) {
+                            const HardenedCookieAgent = createCookieAgent(HardenedHttpsAgent);
+                            options.httpsAgent = new HardenedCookieAgent({ ...httpsCookieAgentOptions,
+                                ...hardenedHttpsAgentOptions });
+                        } else {
+                            options.httpsAgent = new HttpsCookieAgent(httpsCookieAgentOptions);
+                        }
                     }
 
                     if (this.auth_method === "mtls") {

server/utils/kuma-bindable-log-sink.js

@@ -0,0 +1,48 @@
+const { log } = require("../../src/util");
+
+/**
+ * Formats a value for logging purposes
+ * @param {*} v The value to format
+ * @returns {string} The formatted string representation
+ */
+function formatValue(v) {
+    if (typeof v === "string") {
+        return v;
+    }
+    if (v instanceof Error) {
+        return v.stack || v.message || String(v);
+    }
+    try {
+        return JSON.stringify(v);
+    } catch {
+        return String(v);
+    }
+}
+
+module.exports = {
+    /**
+     * Log sink for `hardened-https-agent` library that will redirect its logs to Kuma's logger system
+     */
+    kumaBindableLogSink: {
+        bind: (component) => {
+            const toKumaMsg = (message, args) => {
+                if (!args || args.length === 0) {
+                    return message;
+                }
+                const parts = [ message, ...args ].map((v) => formatValue(v));
+                return parts.join(" ");
+            };
+
+            return {
+                debug: (message, ...args) =>
+                    log.debug(component, toKumaMsg(message, args)),
+                info: (message, ...args) =>
+                    log.info(component, toKumaMsg(message, args)),
+                warn: (message, ...args) =>
+                    log.warn(component, toKumaMsg(message, args)),
+                error: (message, ...args) =>
+                    log.error(component, toKumaMsg(message, args)),
+            };
+        },
+    },
+};