Added loginkey support to meshctrl.js, #3115
Ylian Saint-Hilaire committed
Sep 10, 2021 at 13:04 UTC
15d8f4b027d27f77a01e85f51cad820648df3f8d
3 files changed
+13
-8
meshcentral.js
+1
@@ -2767,6 +2767,7 @@ function CreateMeshCentralServer(config, args) {
2767
if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 160)) {
2768
// Key is present, use it.
2769
obj.loginCookieEncryptionKey = Buffer.from(docs[0].key, 'hex');
2770
+ console.log('obj.loginCookieEncryptionKey', obj.loginCookieEncryptionKey);
2771
func(obj.encodeCookie({ u: userid, a: 3 }, obj.loginCookieEncryptionKey));
2772
} else {
2773
// Key is not present, generate one.
meshctrl.js
+7
-6
@@ -968,7 +968,7 @@ function displayConfigHelp() {
968
}
969
970
function performConfigOperations(args) {
971
- var domainValues = ['title', 'title2', 'titlepicture', 'trustedcert', 'welcomepicture', 'welcometext', 'userquota', 'meshquota', 'newaccounts', 'usernameisemail', 'newaccountemaildomains', 'newaccountspass', 'newaccountsrights', 'geolocation', 'lockagentdownload', 'userconsentflags', 'Usersessionidletimeout', 'auth', 'ldapoptions', 'ldapusername', 'ldapuserbinarykey', 'ldapuseremail', 'footer', 'certurl', 'loginKey', 'userallowedip', 'agentallowedip', 'agentnoproxy', 'agentconfig', 'orphanagentuser', 'httpheaders', 'yubikey', 'passwordrequirements', 'limits', 'amtacmactivation', 'redirects', 'sessionrecording', 'hide', 'loginkey'];
971
+ var domainValues = ['title', 'title2', 'titlepicture', 'trustedcert', 'welcomepicture', 'welcometext', 'userquota', 'meshquota', 'newaccounts', 'usernameisemail', 'newaccountemaildomains', 'newaccountspass', 'newaccountsrights', 'geolocation', 'lockagentdownload', 'userconsentflags', 'Usersessionidletimeout', 'auth', 'ldapoptions', 'ldapusername', 'ldapuserbinarykey', 'ldapuseremail', 'footer', 'certurl', 'loginKey', 'userallowedip', 'agentallowedip', 'agentnoproxy', 'agentconfig', 'orphanagentuser', 'httpheaders', 'yubikey', 'passwordrequirements', 'limits', 'amtacmactivation', 'redirects', 'sessionrecording', 'hide'];
972
var domainObjectValues = [ 'ldapoptions', 'httpheaders', 'yubikey', 'passwordrequirements', 'limits', 'amtacmactivation', 'redirects', 'sessionrecording' ];
973
var domainArrayValues = [ 'newaccountemaildomains', 'newaccountsrights', 'loginkey', 'agentconfig' ];
974
var configChange = false;
@@ -1111,19 +1111,19 @@ function serverConnect() {
1111
}
1112
1113
// Cookie authentication
1114
- var ckey = null;
1114
+ var ckey = null, loginCookie = null;
1115
if (args.loginkey != null) {
1116
// User key passed in a argument hex
1117
- if (args.loginkey.length != 160) { console.log("Invalid login key."); process.exit(); return; }
1117
+ if (args.loginkey.length != 160) { loginCookie = args.loginkey; }
1118
ckey = Buffer.from(args.loginkey, 'hex');
1119
- if (ckey != 80) { console.log("Invalid login key."); process.exit(); return; }
1119
+ if (ckey != 80) { ckey = null; loginCookie = args.loginkey; }
1120
} else if (args.loginkeyfile != null) {
1121
// Load key from hex file
1122
var fs = require('fs');
1123
try {
1124
var keydata = fs.readFileSync(args.loginkeyfile, 'utf8').split(' ').join('').split('\r').join('').split('\n').join('');
1125
ckey = Buffer.from(keydata, 'hex');
1126
- if (ckey.length != 80) { console.log("Invalid login key file."); process.exit(); return; }
1126
+ if (ckey.length != 80) { ckey = null; loginCookie = args.loginkey; }
1127
} catch (ex) { console.log(ex.message); process.exit(); return; }
1128
}
1129
@@ -1135,10 +1135,11 @@ function serverConnect() {
1135
url += '?auth=' + encodeCookie({ userid: 'user/' + domainid + '/' + username, domainid: domainid }, ckey);
1136
} else {
1137
if (args.logindomain != null) { console.log("--logindomain can only be used along with --loginkey."); process.exit(); return; }
1138
+ if (loginCookie != null) { url += '?auth=' + loginCookie; }
1139
}
1140
1141
const ws = new WebSocket(url, options);
1141
- //console.log('Connecting to ' + url);
1142
+ console.log('Connecting to ' + url);
1143
1144
ws.on('open', function open() {
1145
//console.log('Connected.');
webserver.js
+5
-2
@@ -6473,9 +6473,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6473
parent.debug('web', 'ERR: Invalid cookie IP address, got \"' + cookie.ip + '\", expected \"' + cleanRemoteAddr(req.clientIp) + '\".');
6474
cookie = null;
6475
}
6476
- if ((cookie != null) && (obj.users[cookie.userid]) && (cookie.domainid == domain.id)) {
6477
- // Valid cookie, we are authenticated
6476
+ if ((cookie != null) && (cookie.userid != null) && (obj.users[cookie.userid]) && (cookie.domainid == domain.id) && (cookie.userid.split('/')[1] == domain.id)) {
6477
+ // Valid cookie, we are authenticated. Cookie of format { userid: 'user//name', domain: '' }
6478
func(ws, req, domain, obj.users[cookie.userid], cookie);
6479
+ } else if ((cookie != null) && (cookie.a === 3) && (typeof cookie.u == 'string') && (obj.users[cookie.u]) && (cookie.u.split('/')[1] == domain.id)) {
6480
+ // Valid cookie, we are authenticated. Cookie of format { u: 'user//name', a: 3 }
6481
+ func(ws, req, domain, obj.users[cookie.u], cookie);
6482
} else {
6483
// This is a bad cookie, keep going anyway, maybe we have a active session that will save us.
6484
if ((cookie != null) && (cookie.domainid != domain.id)) { parent.debug('web', 'ERR: Invalid domain, got \"' + cookie.domainid + '\", expected \"' + domain.id + '\".'); }