Many web relay improvements and fixes (#4467, #4456)
Ylian Saint-Hilaire committed
Aug 30, 2022 at 17:53 UTC
0bf459bb51b6050b756f583adf0f0c3ed7e2758e
4 files changed
+18
-7
apprelays.js
+14
-3
@@ -260,6 +260,15 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
260
// Called when we need to close the tunnel because the response stream has closed
261
function handleResponseClosure() { obj.close(); }
262
263
+ // Return copkie name and values
264
+ function parseRequestCookies(cookiesString) {
265
+ var r = {};
266
+ if (typeof cookiesString != 'string') return r;
267
+ var cookieString = cookiesString.split('; ');
268
+ for (var i in cookieString) { var j = cookieString[i].indexOf('='); if (j > 0) { r[cookieString[i].substring(0, j)] = cookieString[i].substring(j + 1); } }
269
+ return r;
270
+ }
271
+
272
// Process a HTTP request
273
obj.processRequest = function (req, res) {
274
if (obj.relayActive == false) { console.log("ERROR: Attempt to use an unconnected tunnel"); return false; }
@@ -277,6 +286,8 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
286
for (var i in req.headers) { if (blockedHeaders.indexOf(i) == -1) { request += i + ': ' + req.headers[i] + '\r\n'; } }
287
var cookieStr = '';
288
for (var i in parent.webCookies) { if (cookieStr != '') { cookieStr += '; ' } cookieStr += (i + '=' + parent.webCookies[i].value); }
289
+ var reqCookies = parseRequestCookies(req.headers.cookie);
290
+ for (var i in reqCookies) { if ((i != 'xid') && (i != 'xid.sig')) { if (cookieStr != '') { cookieStr += '; ' } cookieStr += (i + '=' + reqCookies[i]); } }
291
if (cookieStr.length > 0) { request += 'cookie: ' + cookieStr + '\r\n' } // If we have session cookies, set them in the header here
292
request += '\r\n';
293
@@ -677,7 +688,7 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
688
// If there is a header, send it
689
if (header != null) {
690
obj.res.status(parseInt(header.Directive[1])); // Set the status
680
- const blockHeaders = ['Directive', 'sec-websocket-extensions', 'connection', 'transfer-encoding']; // We do not forward these headers
691
+ const blockHeaders = ['Directive', 'sec-websocket-extensions', 'connection', 'transfer-encoding', 'last-modified', 'content-security-policy', 'cache-control']; // We do not forward these headers
692
for (var i in header) {
693
if (i == 'set-cookie') {
694
for (var ii in header[i]) {
@@ -704,8 +715,8 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
715
}
716
else if (blockHeaders.indexOf(i) == -1) { obj.res.set(i, header[i]); } // Set the headers if not blocked
717
}
707
- obj.res.set('Content-Security-Policy', "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:;"); // Set an "allow all" policy, see if the can restrict this in the future
708
- obj.res.set('Cache-Control', 'no-cache'); // Tell the browser not to cache the responses since since the relay port can be used for many relays
718
+ obj.res.set('Content-Security-Policy', "default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';"); // Set an "allow all" policy, see if the can restrict this in the future
719
+ obj.res.set('Cache-Control', 'no-store'); // Tell the browser not to cache the responses since since the relay port can be used for many relays
720
}
721
722
// If there is data, send it
meshcentral.js
+2
-2
@@ -3471,7 +3471,7 @@ function CreateMeshCentralServer(config, args) {
3471
obj.decodeCookie = function (cookie, key, timeout) {
3472
if (cookie == null) return null;
3473
var r = obj.decodeCookieAESGCM(cookie, key, timeout);
3474
- if (r == null) { r = obj.decodeCookieAESSHA(cookie, key, timeout); }
3474
+ if (r === -1) { r = obj.decodeCookieAESSHA(cookie, key, timeout); } // If decodeCookieAESGCM() failed to decode, try decodeCookieAESSHA()
3475
if ((r == null) && (obj.args.cookieencoding == null) && (cookie.length != 64) && ((cookie == cookie.toLowerCase()) || (cookie == cookie.toUpperCase()))) {
3476
obj.debug('cookie', 'Upper/Lowercase cookie, try "CookieEncoding":"hex" in settings section of config.json.');
3477
console.log('Upper/Lowercase cookie, try "CookieEncoding":"hex" in settings section of config.json.');
@@ -3523,7 +3523,7 @@ function CreateMeshCentralServer(config, args) {
3523
}
3524
obj.debug('cookie', 'Decoded AESGCM cookie: ' + JSON.stringify(o));
3525
return o;
3526
- } catch (ex) { obj.debug('cookie', 'ERR: Bad AESGCM cookie due to exception: ' + ex); return null; }
3526
+ } catch (ex) { obj.debug('cookie', 'ERR: Bad AESGCM cookie due to exception: ' + ex); return -1; }
3527
};
3528
3529
// Decode a cookie back into an object using a key using AES256 / HMAC-SHA384. Return null if it's not a valid cookie. (key must be 80 bytes or more)
webrelayserver.js
+1
-1
@@ -188,7 +188,7 @@ module.exports.CreateWebRelayServer = function (parent, db, args, certificates,
188
189
// Decode and check if this relay cookie is valid
190
var userid, domainid, domain, nodeid, addr, port, appid, webSessionId, expire;
191
- const urlCookie = obj.parent.decodeCookie(req.query.c, parent.loginCookieEncryptionKey);
191
+ const urlCookie = obj.parent.decodeCookie(req.query.c, parent.loginCookieEncryptionKey, 32); // Allow cookies up to 32 minutes old. The web page will renew this cookie every 30 minutes.
192
if (urlCookie == null) { res.sendStatus(404); return; }
193
194
// Decode the incomign cookie
webserver.js
+1
-1
@@ -6574,7 +6574,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6574
6575
// Decode and check if this relay cookie is valid
6576
var userid, domainid, domain, nodeid, addr, port, appid, webSessionId, expire;
6577
- const urlCookie = obj.parent.decodeCookie(req.query.c, parent.loginCookieEncryptionKey);
6577
+ const urlCookie = obj.parent.decodeCookie(req.query.c, parent.loginCookieEncryptionKey, 32); // Allow cookies up to 32 minutes old. The web page will renew this cookie every 30 minutes.
6578
if (urlCookie == null) { res.sendStatus(404); return; }
6579
6580
// Decode the incomign cookie