Started work on HTTP web relay, #4172
Ylian Saint-Hilaire committed
Jun 24, 2022 at 14:34 UTC
4dd5c18db43ba80aefef52ae3258a1c1ccbd88c8
4 files changed
+103
-1
MeshCentralServer.njsproj
+3
@@ -239,6 +239,7 @@
239
<Compile Include="translate\translate.js" />
240
<Compile Include="ua-parser.js" />
241
<Compile Include="webauthn.js" />
242
+ <Compile Include="webrelayserver.js" />
243
<Compile Include="webserver.js" />
244
<Compile Include="winservice.js" />
245
<Content Include="agents\codesign.cer" />
@@ -696,6 +697,7 @@
697
<Folder Include="typings\globals\localforage\" />
698
<Folder Include="typings\globals\lru-cache\" />
699
<Folder Include="typings\globals\marked\" />
700
+ <Folder Include="typings\globals\moment-timezone\" />
701
<Folder Include="typings\globals\moment\" />
702
<Folder Include="typings\globals\node-forge\" />
703
<Folder Include="typings\globals\nodemailer\" />
@@ -736,6 +738,7 @@
738
<TypeScriptCompile Include="typings\globals\localforage\index.d.ts" />
739
<TypeScriptCompile Include="typings\globals\lru-cache\index.d.ts" />
740
<TypeScriptCompile Include="typings\globals\marked\index.d.ts" />
741
+ <TypeScriptCompile Include="typings\globals\moment-timezone\index.d.ts" />
742
<TypeScriptCompile Include="typings\globals\moment\index.d.ts" />
743
<TypeScriptCompile Include="typings\globals\node-forge\index.d.ts" />
744
<TypeScriptCompile Include="typings\globals\nodemailer\index.d.ts" />
meshcentral.js
+5
@@ -1646,6 +1646,11 @@ function CreateMeshCentralServer(config, args) {
1646
obj.webserver = require('./webserver.js').CreateWebServer(obj, obj.db, obj.args, obj.certificates, obj.StartEx5);
1647
if (obj.redirserver != null) { obj.redirserver.hookMainWebServer(obj.certificates); }
1648
1649
+ // Start the HTTP relay web server if needed
1650
+ if ((obj.args.relayport != null) && (obj.args.relayport != 0)) {
1651
+ obj.webrelayserver = require('./webrelayserver.js').CreateWebRelayServer(obj, obj.db, obj.args, obj.certificates, function () { });
1652
+ }
1653
+
1654
// Update proxy certificates
1655
if (obj.supportsProxyCertificatesRequest == true) { obj.updateProxyCertificates(true); }
1656
redirserver.js
+1
-1
@@ -142,7 +142,7 @@ module.exports.CreateRedirServer = function (parent, db, args, func) {
142
obj.parent.updateServerState('redirect-port', port);
143
func(obj.port);
144
}).on('error', function (err) {
145
- if ((err.code == 'EACCES') && (port < 65535)) { StartRedirServer(port + 1); } else { console.log(err); func(obj.port); }
145
+ if ((err.code == 'EACCES') && (port < 65535)) { StartRedirServer(port + 1, addr); } else { console.log(err); func(obj.port); }
146
});
147
}
148
webrelayserver.js
new
+94
@@ -0,0 +1,94 @@
1
+/**
2
+* @description Meshcentral web relay server
3
+* @author Ylian Saint-Hilaire
4
+* @copyright Intel Corporation 2018-2022
5
+* @license Apache-2.0
6
+* @version v0.0.1
7
+*/
8
+
9
+/*jslint node: true */
10
+/*jshint node: true */
11
+/*jshint strict:false */
12
+/*jshint -W097 */
13
+/*jshint esversion: 6 */
14
+"use strict";
15
+
16
+// Construct a HTTP redirection web server object
17
+module.exports.CreateWebRelayServer = function (parent, db, args, certificates, func) {
18
+ var obj = {};
19
+ obj.parent = parent;
20
+ obj.db = db;
21
+ obj.express = require('express');
22
+ obj.expressWs = null;
23
+ obj.tlsServer = null;
24
+ obj.net = require('net');
25
+ obj.app = obj.express();
26
+ obj.webRelayServer = null;
27
+ obj.port = null;
28
+ const constants = (require('crypto').constants ? require('crypto').constants : require('constants')); // require('constants') is deprecated in Node 11.10, use require('crypto').constants instead.
29
+ var tlsSessionStore = {}; // Store TLS session information for quick resume.
30
+ var tlsSessionStoreCount = 0; // Number of cached TLS session information in store.
31
+
32
+ // Add HTTP security headers to all responses
33
+ obj.app.use(function (req, res, next) {
34
+ parent.debug('webrequest', req.url + ' (RelayServer)');
35
+ res.removeHeader('X-Powered-By');
36
+ res.set({
37
+ 'strict-transport-security': 'max-age=60000; includeSubDomains',
38
+ 'Referrer-Policy': 'no-referrer',
39
+ 'x-frame-options': 'SAMEORIGIN',
40
+ 'X-XSS-Protection': '1; mode=block',
41
+ 'X-Content-Type-Options': 'nosniff',
42
+ 'Content-Security-Policy': "default-src 'none'; style-src 'self' 'unsafe-inline';"
43
+ });
44
+ return next();
45
+ });
46
+
47
+ // Start the server, only after users and meshes are loaded from the database.
48
+ if (args.tlsoffload) {
49
+ // Setup the HTTP server without TLS
50
+ obj.expressWs = require('express-ws')(obj.app, null, { wsOptions: { perMessageDeflate: (args.wscompression === true) } });
51
+ } else {
52
+ // Setup the HTTP server with TLS, use only TLS 1.2 and higher with perfect forward secrecy (PFS).
53
+ const tlsOptions = { cert: certificates.web.cert, key: certificates.web.key, ca: certificates.web.ca, rejectUnauthorized: true, ciphers: "HIGH:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_CHACHA20_POLY1305_SHA256", secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_NO_TLSv1 | constants.SSL_OP_NO_TLSv1_1 };
54
+ obj.tlsServer = require('https').createServer(tlsOptions, obj.app);
55
+ obj.tlsServer.on('secureConnection', function () { /*console.log('tlsServer secureConnection');*/ });
56
+ obj.tlsServer.on('error', function (err) { console.log('tlsServer error', err); });
57
+ obj.tlsServer.on('newSession', function (id, data, cb) { if (tlsSessionStoreCount > 1000) { tlsSessionStoreCount = 0; tlsSessionStore = {}; } tlsSessionStore[id.toString('hex')] = data; tlsSessionStoreCount++; cb(); });
58
+ obj.tlsServer.on('resumeSession', function (id, cb) { cb(null, tlsSessionStore[id.toString('hex')] || null); });
59
+ obj.expressWs = require('express-ws')(obj.app, obj.tlsServer, { wsOptions: { perMessageDeflate: (args.wscompression === true) } });
60
+ }
61
+
62
+ // Find a free port starting with the specified one and going up.
63
+ function CheckListenPort(port, addr, func) {
64
+ var s = obj.net.createServer(function (socket) { });
65
+ obj.webRelayServer = s.listen(port, addr, function () { s.close(function () { if (func) { func(port, addr); } }); }).on("error", function (err) {
66
+ if (args.exactports) { console.error("ERROR: MeshCentral HTTP relay server port " + port + " not available."); process.exit(); }
67
+ else { if (port < 65535) { CheckListenPort(port + 1, addr, func); } else { if (func) { func(0); } } }
68
+ });
69
+ }
70
+
71
+ // Start the ExpressJS web server, if the port is busy try the next one.
72
+ function StartWebRelayServer(port, addr) {
73
+ if (port == 0 || port == 65535) { return; }
74
+ if (obj.tlsServer != null) {
75
+ if (args.lanonly == true) {
76
+ obj.tcpServer = obj.tlsServer.listen(port, addr, function () { console.log('MeshCentral HTTPS relay server running on port ' + port + ((args.aliasport != null) ? (', alias port ' + args.aliasport) : '') + '.'); });
77
+ } else {
78
+ obj.tcpServer = obj.tlsServer.listen(port, addr, function () { console.log('MeshCentral HTTPS relay server running on ' + certificates.CommonName + ':' + port + ((args.aliasport != null) ? (', alias port ' + args.aliasport) : '') + '.'); });
79
+ obj.parent.updateServerState('servername', certificates.CommonName);
80
+ }
81
+ if (obj.parent.authlog) { obj.parent.authLog('https', 'Web relay server listening on ' + ((addr != null) ? addr : '0.0.0.0') + ' port ' + port + '.'); }
82
+ obj.parent.updateServerState('https-relay-port', port);
83
+ if (args.aliasport != null) { obj.parent.updateServerState('https-relay-aliasport', args.aliasport); }
84
+ } else {
85
+ obj.tcpServer = obj.app.listen(port, addr, function () { console.log('MeshCentral HTTP relay server running on port ' + port + ((args.aliasport != null) ? (', alias port ' + args.aliasport) : '') + '.'); });
86
+ obj.parent.updateServerState('http-relay-port', port);
87
+ if (args.aliasport != null) { obj.parent.updateServerState('http-relay-aliasport', args.aliasport); }
88
+ }
89
+ }
90
+
91
+ CheckListenPort(args.relayport, args.relayportbind, StartWebRelayServer);
92
+
93
+ return obj;
94
+};