|
1 | 1 | import { BaseManager } from './Base' |
2 | | -import { execPromise } from '../util' |
| 2 | +import { execPromise, isLinux, isMacOS } from '../util' |
| 3 | +import { join } from 'node:path' |
3 | 4 |
|
4 | 5 | class Manager extends BaseManager { |
5 | | - sslAddTrustedCert(cwd: string, caName: string): Promise<boolean> { |
6 | | - return new Promise(async (resolve, reject) => { |
| 6 | + async sslAddTrustedCert(cwd: string, caName: string): Promise<boolean> { |
| 7 | + if (isMacOS()) { |
| 8 | + await execPromise( |
| 9 | + `security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "${caName}"`, |
| 10 | + { |
| 11 | + cwd |
| 12 | + } |
| 13 | + ) |
| 14 | + } else if (isLinux()) { |
| 15 | + const caFile = join(cwd, caName) |
| 16 | + // 检查常见的 CA 信任目录 |
| 17 | + const debianUbuntuPath = `/usr/local/share/ca-certificates/${caName}` |
| 18 | + const centosFedoraPath = `/etc/pki/ca-trust/source/anchors/${caName}` |
| 19 | + |
| 20 | + let error = false |
7 | 21 | try { |
8 | | - await execPromise( |
9 | | - `security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "${caName}"`, |
10 | | - { |
11 | | - cwd |
12 | | - } |
13 | | - ) |
14 | | - } catch (e) { |
15 | | - reject(e) |
16 | | - return |
| 22 | + // 尝试复制到 Debian/Ubuntu 风格的路径 |
| 23 | + await execPromise(`sudo cp "${caFile}" "${debianUbuntuPath}"`) |
| 24 | + // 更新证书 |
| 25 | + await execPromise('sudo update-ca-certificates') |
| 26 | + } catch { |
| 27 | + error = true |
| 28 | + } |
| 29 | + if (error) { |
| 30 | + try { |
| 31 | + await execPromise(`sudo cp "${caFile}" "${centosFedoraPath}"`) |
| 32 | + // 更新证书 |
| 33 | + await execPromise('sudo update-ca-trust extract') |
| 34 | + } catch {} |
17 | 35 | } |
18 | | - resolve(true) |
19 | | - }) |
| 36 | + } |
| 37 | + return true |
20 | 38 | } |
21 | 39 |
|
22 | | - sslFindCertificate(cwd: string) { |
23 | | - return new Promise(async (resolve, reject) => { |
24 | | - try { |
25 | | - const res = await execPromise(`security find-certificate -c "FlyEnv-Root-CA"`, { |
| 40 | + async sslFindCertificate( |
| 41 | + cwd: string, |
| 42 | + commonName: string = 'FlyEnv-Root-CA' |
| 43 | + ): Promise<{ stdout: string; stderr: string }> { |
| 44 | + try { |
| 45 | + if (isMacOS()) { |
| 46 | + const res = await execPromise(`security find-certificate -c "${commonName}"`, { |
26 | 47 | cwd |
27 | 48 | }) |
28 | | - resolve({ |
| 49 | + return { |
29 | 50 | stdout: res.stdout, |
30 | 51 | stderr: res.stderr |
31 | | - }) |
32 | | - } catch (e) { |
33 | | - reject(e) |
| 52 | + } |
| 53 | + } else if (isLinux()) { |
| 54 | + // Linux 查找证书比较复杂，通常需要遍历目录和解析证书文件 |
| 55 | + // 这是一个非常简化的实现，它会检查常见的CA目录中是否存在文件， |
| 56 | + // 并尝试使用 openssl x509 -text 来查找 Common Name |
| 57 | + const commonCaPaths = [ |
| 58 | + '/etc/ssl/certs/', |
| 59 | + '/usr/local/share/ca-certificates/', |
| 60 | + '/etc/pki/ca-trust/extracted/pem/', // CentOS/RHEL/Fedora 提取的路径 |
| 61 | + '/etc/pki/tls/certs/' |
| 62 | + ] |
| 63 | + |
| 64 | + let foundCertPath = '' |
| 65 | + |
| 66 | + for (const dir of commonCaPaths) { |
| 67 | + try { |
| 68 | + // 尝试列出目录中的所有 .crt 文件 |
| 69 | + const { stdout: files } = await execPromise( |
| 70 | + `find "${dir}" -name "*.crt" -print 2>/dev/null` |
| 71 | + ) |
| 72 | + const certFiles = files |
| 73 | + .split('\n') |
| 74 | + .map((s) => s.trim()) |
| 75 | + .filter((s) => !!s) |
| 76 | + |
| 77 | + for (const filePath of certFiles) { |
| 78 | + try { |
| 79 | + // 使用 openssl 检查证书的 Common Name |
| 80 | + const { stdout: certInfo } = await execPromise( |
| 81 | + `openssl x509 -in "${filePath}" -text -noout` |
| 82 | + ) |
| 83 | + if (certInfo.includes(`CN = ${commonName}`)) { |
| 84 | + foundCertPath = filePath |
| 85 | + break // 找到后跳出内层循环 |
| 86 | + } |
| 87 | + } catch {} |
| 88 | + } |
| 89 | + if (foundCertPath) break // 找到后跳出外层循环 |
| 90 | + } catch {} |
| 91 | + } |
| 92 | + |
| 93 | + if (foundCertPath) { |
| 94 | + return { |
| 95 | + stdout: `Found certificate: ${foundCertPath}\n`, |
| 96 | + stderr: '' |
| 97 | + } |
| 98 | + } else { |
| 99 | + return { |
| 100 | + stdout: '', |
| 101 | + stderr: `Certificate with CN "${commonName}" not found on Linux.` |
| 102 | + } |
| 103 | + } |
34 | 104 | } |
35 | | - }) |
| 105 | + return { stdout: '', stderr: '' } // 如果不是 macOS 或 Linux，返回空 |
| 106 | + } catch (e: any) { |
| 107 | + return { stdout: '', stderr: `${e}` } |
| 108 | + } |
36 | 109 | } |
37 | 110 |
|
38 | | - dnsRefresh() { |
39 | | - return new Promise(async (resolve) => { |
40 | | - try { |
41 | | - await execPromise(`dscacheutil -flushcache`) |
42 | | - } catch {} |
43 | | - try { |
44 | | - await execPromise(`killall -HUP mDNSResponder`) |
45 | | - } catch {} |
46 | | - resolve(true) |
47 | | - }) |
| 111 | + /** |
| 112 | + * 刷新系统 DNS 缓存。 |
| 113 | + * 注意：Linux 上 DNS 刷新方法因使用的 DNS 解析器而异。 |
| 114 | + * @returns Promise<boolean> 操作成功返回 true。 |
| 115 | + */ |
| 116 | + async dnsRefresh(): Promise<boolean> { |
| 117 | + try { |
| 118 | + if (isMacOS()) { |
| 119 | + try { |
| 120 | + await execPromise(`dscacheutil -flushcache`) |
| 121 | + } catch (e) { |
| 122 | + console.warn(`Error flushing dscacheutil: ${e}`) |
| 123 | + } |
| 124 | + try { |
| 125 | + await execPromise(`killall -HUP mDNSResponder`) |
| 126 | + } catch (e) { |
| 127 | + console.warn(`Error killing mDNSResponder: ${e}`) |
| 128 | + } |
| 129 | + } else if (isLinux()) { |
| 130 | + // 尝试常见的 Linux DNS 刷新方法 |
| 131 | + // 1. systemd-resolved (新版系统，如 Ubuntu 18.04+, Fedora, CentOS 7+) |
| 132 | + try { |
| 133 | + await execPromise(`sudo systemctl restart systemd-resolved.service`) |
| 134 | + console.log('systemd-resolved restarted.') |
| 135 | + return true // 如果成功，直接返回 |
| 136 | + } catch (e) { |
| 137 | + console.warn(`systemd-resolved not found or restart failed: ${e}`) |
| 138 | + } |
| 139 | + |
| 140 | + // 2. nscd (Name Service Cache Daemon) |
| 141 | + try { |
| 142 | + await execPromise(`sudo systemctl restart nscd.service`) |
| 143 | + console.log('nscd restarted.') |
| 144 | + return true // 如果成功，直接返回 |
| 145 | + } catch (e) { |
| 146 | + console.warn(`nscd not found or restart failed: ${e}`) |
| 147 | + } |
| 148 | + |
| 149 | + // 3. dnsmasq (如果作为本地 DNS 缓存服务) |
| 150 | + try { |
| 151 | + await execPromise(`sudo systemctl restart dnsmasq.service`) |
| 152 | + console.log('dnsmasq restarted.') |
| 153 | + return true // 如果成功，直接返回 |
| 154 | + } catch (e) { |
| 155 | + console.warn(`dnsmasq not found or restart failed: ${e}`) |
| 156 | + } |
| 157 | + |
| 158 | + // 如果以上都没有成功，可能没有特定的 DNS 缓存服务或需要手动清除 |
| 159 | + console.warn( |
| 160 | + 'Could not determine or refresh system DNS cache on Linux. Manual intervention might be needed.' |
| 161 | + ) |
| 162 | + } |
| 163 | + } catch {} |
| 164 | + return true |
48 | 165 | } |
49 | 166 | } |
50 | 167 |
|
|
0 commit comments