Improved session id random in meshrelay.js.

Ylian Saint-Hilaire committed Jul 18, 2022 at 22:56 UTC 49cac98430dcce9c719acef606ee91099c24edfd
1 file changed +4 -5
meshrelay.js
+4 -5
@@ -879,7 +879,7 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
879 const rcookieData = {};
880 if (user != null) { rcookieData.ruserid = user._id; } else if (obj.nouser === true) { rcookieData.nouser = 1; }
881 const rcookie = parent.parent.encodeCookie(rcookieData, parent.parent.loginCookieEncryptionKey);
882 - if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
882 + if (obj.id == null) { obj.id = parent.crypto.randomBytes(9).toString('base64'); } // If there is no connection id, generate one.
883 const command = { nodeid: cookie.nodeid, action: 'msg', type: 'tunnel', value: '*/' + xdomain + 'meshrelay.ashx?id=' + obj.id + '&rauth=' + rcookie, tcpport: cookie.tcpport, tcpaddr: cookie.tcpaddr, soptions: {} };
884 if (user) { command.userid = user._id; }
885 if (typeof domain.consentmessages == 'object') {
@@ -915,9 +915,8 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
915 obj.meshid = node.meshid;
916
917 // Send connection request to agent
918 - if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
918 + if (obj.id == null) { obj.id = parent.crypto.randomBytes(9).toString('base64'); } // If there is no connection id, generate one.
919 const rcookie = parent.parent.encodeCookie({ ruserid: user._id }, parent.parent.loginCookieEncryptionKey);
920 -
920 if (obj.req.query.tcpport != null) {
921 const command = { nodeid: obj.req.query.nodeid, action: 'msg', type: 'tunnel', userid: user._id, value: '*/' + xdomain + 'meshrelay.ashx?id=' + obj.id + '&rauth=' + rcookie, tcpport: obj.req.query.tcpport, tcpaddr: ((obj.req.query.tcpaddr == null) ? '127.0.0.1' : obj.req.query.tcpaddr), soptions: {} };
922 if (typeof domain.consentmessages == 'object') {
@@ -972,7 +971,7 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
971 obj.meshid = node.meshid;
972
973 // Send connection request to agent
975 - if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); }
974 + if (obj.id == null) { obj.id = parent.crypto.randomBytes(9).toString('base64'); } // If there is no connection id, generate one.
975 const rcookieData = { nodeid: node._id };
976 if (user != null) { rcookieData.ruserid = user._id; } else if (obj.nouser === true) { rcookieData.nouser = 1; }
977 const rcookie = parent.parent.encodeCookie(rcookieData, parent.parent.loginCookieEncryptionKey);
@@ -1118,7 +1117,7 @@ module.exports.CreateLocalRelay = function (parent, ws, req, domain, user, cooki
1117 function CreateLocalRelayEx(parent, ws, req, domain, user, cookie) {
1118 const net = require('net');
1119 var obj = {};
1121 - obj.id = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
1120 + obj.id = parent.crypto.randomBytes(9).toString('base64');
1121 obj.req = req;
1122 obj.ws = ws;
1123 obj.user = user;