Added user IP filtering.
Ylian Saint-Hilaire committed
Sep 27, 2017 at 12:43 UTC
646bc673651ca8ea5cdb2ac033bf128e30837a98
5 files changed
+116
-17
meshcentral.js
+26
-15
@@ -26,8 +26,6 @@ function CreateMeshCentralServer() {
26
obj.debugLevel = 0;
27
obj.config = {}; // Configuration file
28
obj.dbconfig = {}; // Persistance values, loaded from database
29
- obj.datapath = obj.path.join(__dirname, '../.meshcentral-data');
30
- obj.filespath = obj.path.join(__dirname, '../.meshcentral-files');
29
obj.certificateOperations = require('./certoperations.js').CertificateOperations();
30
obj.defaultMeshCore = null;
31
obj.defaultMeshCoreHash = null;
@@ -38,6 +36,15 @@ function CreateMeshCentralServer() {
36
obj.maintenanceTimer = null;
37
obj.serverId = null;
38
39
+ // Setup the default configuration and files paths
40
+ if ((__dirname.endsWith('/node_modules/meshcentral')) || (__dirname.endsWith('\\node_modules\\meshcentral')) || (__dirname.endsWith('/node_modules/meshcentral/')) || (__dirname.endsWith('\\node_modules\\meshcentral\\'))) {
41
+ obj.datapath = obj.path.join(__dirname, '../../.meshcentral-data');
42
+ obj.filespath = obj.path.join(__dirname, '../../.meshcentral-files');
43
+ } else {
44
+ obj.datapath = obj.path.join(__dirname, '../.meshcentral-data');
45
+ obj.filespath = obj.path.join(__dirname, '../.meshcentral-files');
46
+ }
47
+
48
// Create data and files folders if needed
49
try { obj.fs.mkdirSync(obj.datapath); } catch (e) { }
50
try { obj.fs.mkdirSync(obj.filespath); } catch (e) { }
@@ -57,8 +64,8 @@ function CreateMeshCentralServer() {
64
try { require('./pass').hash('test', function () { }); } catch (e) { console.log('Old version of node, must upgrade.'); return; } // TODO: Not sure if this test works or not.
65
66
// Check for invalid arguments
60
- var validArguments = ['_', 'notls', 'user', 'port', 'mpsport', 'redirport', 'cert', 'deletedomain', 'deletedefaultdomain', 'showusers', 'shownodes', 'showmeshes', 'showevents', 'showpower', 'showiplocations', 'help', 'exactports', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpsdebug', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbimport', 'selfupdate', 'tlsoffload'];
61
- for (var arg in obj.args) { if (validArguments.indexOf(arg.toLocaleLowerCase()) == -1) { console.log('Invalid argument "' + arg + '", use --help.'); return; } }
67
+ var validArguments = ['_', 'notls', 'user', 'port', 'mpsport', 'redirport', 'cert', 'deletedomain', 'deletedefaultdomain', 'showusers', 'shownodes', 'showmeshes', 'showevents', 'showpower', 'showiplocations', 'help', 'exactports', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpsdebug', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbimport', 'selfupdate', 'tlsoffload', 'userallowedip'];
68
+ for (var arg in obj.args) { obj.args[arg.toLocaleLowerCase()] = obj.args[arg]; if (validArguments.indexOf(arg.toLocaleLowerCase()) == -1) { console.log('Invalid argument "' + arg + '", use --help.'); return; } }
69
if (obj.args.mongodb == true) { console.log('Must specify: --mongodb [connectionstring] \r\nSee https://docs.mongodb.com/manual/reference/connection-string/ for MongoDB connection string.'); return; }
70
71
if ((obj.args.help == true) || (obj.args['?'] == true)) {
@@ -85,19 +92,19 @@ function CreateMeshCentralServer() {
92
if ((obj.service != null) && ((obj.args.install == true) || (obj.args.uninstall == true) || (obj.args.start == true) || (obj.args.stop == true) || (obj.args.restart == true))) {
93
var env = [], xenv = ['user', 'port', 'mpsport', 'redirport', 'exactport', 'debug'];
94
for (var i in xenv) { if (obj.args[xenv[i]] != null) { env.push({ name: 'mesh' + xenv[i], value: obj.args[xenv[i]] }); } } // Set some args as service environement variables.
88
- var svc = new obj.service({ name: 'MeshCentral', description: 'MeshCentral Remote Management Server', script: process.argv[1] + '.js', env: env, wait: 2, grow: .5 });
95
+ var svc = new obj.service({ name: 'MeshCentral', description: 'MeshCentral Remote Management Server', script: obj.path.join(__dirname, 'meshcentral.js'), env: env, wait: 2, grow: .5 });
96
svc.on('install', function () { console.log('MeshCentral service installed.'); svc.start(); });
97
svc.on('uninstall', function () { console.log('MeshCentral service uninstalled.'); process.exit(); });
98
svc.on('start', function () { console.log('MeshCentral service started.'); process.exit(); });
99
svc.on('stop', function () { console.log('MeshCentral service stopped.'); if (obj.args.stop) { process.exit(); } if (obj.args.restart) { console.log('Holding 5 seconds...'); setTimeout(function () { svc.start(); }, 5000); } });
100
svc.on('alreadyinstalled', function () { console.log('MeshCentral service already installed.'); process.exit(); });
101
svc.on('invalidinstallation', function () { console.log('Invalid MeshCentral service installation.'); process.exit(); });
95
- try {
96
- if (obj.args.install == true) { svc.install(); return; }
97
- else if (obj.args.uninstall == true) { svc.uninstall(); return; }
98
- else if (obj.args.start == true) { svc.start(); return; }
99
- else if (obj.args.stop == true || obj.args.restart == true) { svc.stop(); return; }
100
- } catch (e) { logException(e); }
102
+
103
+ if (obj.args.install == true) { try { svc.install(); } catch (e) { logException(e); } }
104
+ if (obj.args.stop == true || obj.args.restart == true) { try { svc.stop(); } catch (e) { logException(e); } }
105
+ if (obj.args.start == true || obj.args.restart == true) { try { svc.start(); } catch (e) { logException(e); } }
106
+ if (obj.args.uninstall == true) { try { svc.uninstall(); } catch (e) { logException(e); } }
107
+ return;
108
}
109
110
// If "--launch" is in the arguments, launch now
@@ -296,6 +303,9 @@ function CreateMeshCentralServer() {
303
for (var serverid in obj.config.peers.servers) { obj.peerConnectivityByNode[serverid] = {}; }
304
}
305
306
+ // If the server is set to "nousers", allow only loopback unless IP filter is set
307
+ if ((obj.args.nousers == 1) && (obj.args.userallowedip == null)) { obj.args.userallowedip = "::1,127.0.0.1"; }
308
+
309
if (obj.args.secret) {
310
// This secret is used to encrypt HTTP session information, if specified, user it.
311
obj.webserver = require('./webserver.js').CreateWebServer(obj, obj.db, obj.args, obj.args.secret, obj.certificates);
@@ -627,8 +637,8 @@ function CreateMeshCentralServer() {
637
obj.defaultMeshCore = data;
638
obj.defaultMeshCoreHash = obj.crypto.createHash('sha256').update(data).digest("binary");
639
} else {
630
- obj.parent.defaultMeshCore = null;
631
- obj.parent.defaultMeshCoreHash = null;
640
+ obj.defaultMeshCore = null;
641
+ obj.defaultMeshCoreHash = null;
642
}
643
if (func != null) { func(); }
644
});
@@ -640,8 +650,8 @@ function CreateMeshCentralServer() {
650
obj.defaultMeshCore = data;
651
obj.defaultMeshCoreHash = obj.crypto.createHash('sha256').update(data).digest("binary");
652
} else {
643
- obj.parent.defaultMeshCore = null;
644
- obj.parent.defaultMeshCoreHash = null;
653
+ obj.defaultMeshCore = null;
654
+ obj.defaultMeshCoreHash = null;
655
}
656
if (func != null) { func(); }
657
});
@@ -760,6 +770,7 @@ function CreateMeshCentralServer() {
770
var called = false;
771
try {
772
obj.fs.open(filepath, 'r', function (err, fd) {
773
+ if (fd == null) { func(null); return; }
774
obj.fs.fstat(fd, function (err, stats) {
775
var bufferSize = stats.size, chunkSize = 512, buffer = new Buffer(bufferSize), bytesRead = 0;
776
while (bytesRead < bufferSize) {
mesherrors.txt
+44
@@ -107,3 +107,47 @@ TypeError: command.join is not a function
107
at Immediate._onImmediate (C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\node_modules\async\lib\async.js:498:34)
108
109
110
+-------- 9/27/2017, 11:45:48 AM --------
111
+
112
+C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\webserver.js:1
113
+(function (exports, require, module, __filename, __dirname) { * @description Meshcentral web server
114
+ ^
115
+SyntaxError: Unexpected token *
116
+ at exports.runInThisContext (vm.js:53:16)
117
+ at Module._compile (module.js:511:25)
118
+ at Object.Module._extensions..js (module.js:550:10)
119
+ at Module.load (module.js:456:32)
120
+ at tryModuleLoad (module.js:415:12)
121
+ at Function.Module._load (module.js:407:3)
122
+ at Module.require (module.js:466:17)
123
+ at require (internal/module.js:20:19)
124
+ at InternalFieldObject.ondone (C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\meshcentral.js:311:45)
125
+
126
+
127
+-------- 9/27/2017, 11:45:50 AM --------
128
+
129
+C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\webserver.js:1
130
+(function (exports, require, module, __filename, __dirname) { * @description Meshcentral web server
131
+ ^
132
+SyntaxError: Unexpected token *
133
+ at exports.runInThisContext (vm.js:53:16)
134
+ at Module._compile (module.js:511:25)
135
+ at Object.Module._extensions..js (module.js:550:10)
136
+ at Module.load (module.js:456:32)
137
+ at tryModuleLoad (module.js:415:12)
138
+ at Function.Module._load (module.js:407:3)
139
+ at Module.require (module.js:466:17)
140
+ at require (internal/module.js:20:19)
141
+ at InternalFieldObject.ondone (C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\meshcentral.js:311:45)
142
+
143
+
144
+-------- 9/27/2017, 12:40:21 PM --------
145
+
146
+C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\meshcentral.js:307
147
+ if ((obj.args.nousers == 1) && (args.userallowedip == null)) { args.userallowedip = "::1,127.0.0.1"; }
148
+ ^
149
+
150
+ReferenceError: args is not defined
151
+ at InternalFieldObject.ondone (C:\Users\Default.DESKTOP-M9I88C9\Desktop\AmtWebApp\meshcentral\meshcentral.js:307:57)
152
+
153
+
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.0.8-e",
3
+ "version": "0.0.8-g",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
views/default.handlebars
+7
-1
@@ -1742,7 +1742,13 @@
1742
if (node.userloc) { loc = node.userloc; t = 4; }
1743
if ((loc == null) || (typeof loc != 'string')) return;
1744
loc = loc.split(',');
1745
- return [ parseFloat(loc[0]) + (stringToIntHash(node._id.substring(0, 20)) / 100000000000), parseFloat(loc[1]) + (stringToIntHash(node._id.substring(20)) / 100000000000), t ]
1745
+ if (t == 1) {
1746
+ // If this is IP location, randomize the position a little.
1747
+ return [ parseFloat(loc[0]) + (stringToIntHash(node._id.substring(0, 20)) / 100000000000), parseFloat(loc[1]) + (stringToIntHash(node._id.substring(20)) / 100000000000), t ];
1748
+ } else {
1749
+ // Return the real position
1750
+ return [ parseFloat(loc[0]), parseFloat(loc[1]), t ];
1751
+ }
1752
}
1753
1754
// Load the entire map
webserver.js
+38
@@ -65,6 +65,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
65
obj.args = args;
66
obj.users = {};
67
obj.meshes = {};
68
+ obj.userAllowedIp = args.userallowedip; // List of allowed IP addresses for users
69
70
// Perform hash on web certificate and agent certificate
71
obj.webCertificatHash = parent.certificateOperations.forge.pki.getPublicKeyFingerprint(parent.certificateOperations.forge.pki.certificateFromPem(obj.certificates.web.cert).publicKey, { md: parent.certificateOperations.forge.md.sha256.create(), encoding: 'binary' });
@@ -176,6 +177,22 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
177
}
178
*/
179
180
+ // Check if the source IP address is allowed, return false if not
181
+ function checkUserIpAddress(req, res) {
182
+ if (obj.userAllowedIp == null) { return true; }
183
+ try {
184
+ if (typeof obj.userAllowedIp == 'string') { if (obj.userAllowedIp == "") { obj.userAllowedIp = null; return true; } else { obj.userAllowedIp = obj.userAllowedIp.split(','); } }
185
+ var ip = null, type = 0;
186
+ if (req.connection) { ip = req.connection.remoteAddress; type = 1; } // HTTP(S) request
187
+ else if (req._socket) { ip = req._socket.remoteAddress; type = 2; } // WebSocket request
188
+ if (ip.startsWith('::ffff:')) { ip = ip.substring(7); } // Fix IPv4 IP's encoded in IPv6 form
189
+ if ((ip != null) && (obj.userAllowedIp.indexOf(ip) >= 0)) { return true; }
190
+ if (type == 1) { res.sendStatus(401); }
191
+ else if (type == 2) { try { req.close(); } catch (e) { } }
192
+ } catch (e) { console.log(e); }
193
+ return false;
194
+ }
195
+
196
// Return the current domain of the request
197
function getDomain(req) {
198
var x = req.url.split('/');
@@ -185,6 +202,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
202
}
203
204
function handleLogoutRequest(req, res) {
205
+ if (checkUserIpAddress(req, res) == false) { return; }
206
var domain = getDomain(req);
207
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
208
// Destroy the user's session to log them out will be re-created next request
@@ -198,6 +216,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
216
}
217
218
function handleLoginRequest(req, res) {
219
+ if (checkUserIpAddress(req, res) == false) { return; }
220
var domain = getDomain(req);
221
obj.authenticate(req.body.username, req.body.password, domain, function (err, userid, passhint) {
222
if (userid) {
@@ -249,6 +268,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
268
}
269
270
function handleCreateAccountRequest(req, res) {
271
+ if (checkUserIpAddress(req, res) == false) { return; }
272
var domain = getDomain(req);
273
if (domain.newAccounts == 0) { res.sendStatus(401); return; }
274
if (!req.body.username || !req.body.email || !req.body.password1 || !req.body.password2 || (req.body.password1 != req.body.password2) || req.body.username == '~') {
@@ -291,6 +311,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
311
}
312
313
function handleDeleteAccountRequest(req, res) {
314
+ if (checkUserIpAddress(req, res) == false) { return; }
315
var domain = getDomain(req);
316
// Check if the user is logged and we have all required parameters
317
if (!req.session || !req.session.userid || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url); return; }
@@ -313,6 +334,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
334
335
// Handle password changes
336
function handlePasswordChangeRequest(req, res) {
337
+ if (checkUserIpAddress(req, res) == false) { return; }
338
var domain = getDomain(req);
339
// Check if the user is logged and we have all required parameters
340
if (!req.session || !req.session.userid || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url); return; }
@@ -336,6 +358,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
358
359
// Indicates that any request to "/" should render "default" or "login" depending on login state
360
function handleRootRequest(req, res) {
361
+ if (checkUserIpAddress(req, res) == false) { return; }
362
if (!obj.args) { res.sendStatus(500); return; }
363
var domain = getDomain(req);
364
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
@@ -401,6 +424,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
424
425
// Renter the terms of service.
426
function handleTermsRequest(req, res) {
427
+ if (checkUserIpAddress(req, res) == false) { return; }
428
var domain = getDomain(req);
429
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
430
if (req.session && req.session.userid) {
@@ -424,12 +448,14 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
448
449
// Returns the mesh server root certificate
450
function handleRootCertRequest(req, res) {
451
+ if (checkUserIpAddress(req, res) == false) { return; }
452
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=' + certificates.RootName + '.cer' });
453
res.send(new Buffer(getRootCertBase64(), 'base64'));
454
}
455
456
// Returns an mescript for Intel AMT configuration
457
function handleMeScriptRequest(req, res) {
458
+ if (checkUserIpAddress(req, res) == false) { return; }
459
if (req.query.type == 1) {
460
var filename = 'cira_setup.mescript';
461
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=' + filename });
@@ -500,6 +526,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
526
527
// Handle user public file downloads
528
function handleDownloadUserFiles(req, res) {
529
+ if (checkUserIpAddress(req, res) == false) { return; }
530
var domain = getDomain(req), domainname = 'domain', spliturl = decodeURIComponent(req.path).split('/'), filename = '';
531
if ((spliturl.length < 3) || (obj.common.IsFilenameValid(spliturl[2]) == false) || (domain.userQuota == -1)) { res.sendStatus(404); return; }
532
if (domain.id != '') { domainname = 'domain-' + domain.id; }
@@ -522,6 +549,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
549
550
// Download a file from the server
551
function handleDownloadFile(req, res) {
552
+ if (checkUserIpAddress(req, res) == false) { return; }
553
var domain = getDomain(req);
554
if ((req.query.link == null) || (req.session == null) || (req.session.userid == null) || (domain == null) || (domain.userQuota == -1)) { res.sendStatus(404); return; }
555
var user = obj.users[req.session.userid];
@@ -534,6 +562,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
562
563
// Upload a MeshCore.js file to the server
564
function handleUploadMeshCoreFile(req, res) {
565
+ if (checkUserIpAddress(req, res) == false) { return; }
566
var domain = getDomain(req);
567
if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
568
var user = obj.users[req.session.userid];
@@ -558,6 +587,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
587
588
// Upload a file to the server
589
function handleUploadFile(req, res) {
590
+ if (checkUserIpAddress(req, res) == false) { return; }
591
var domain = getDomain(req);
592
if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (domain.userQuota == -1)) { res.sendStatus(401); return; }
593
var user = obj.users[req.session.userid];
@@ -619,6 +649,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
649
650
// Handle a web socket relay request
651
function handleRelayWebSocket(ws, req) {
652
+ if (checkUserIpAddress(ws, req) == false) { return; }
653
var node, domain = getDomain(req);
654
// Check if this is a logged in user
655
var user, peering = true;
@@ -881,6 +912,8 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
912
913
// Handle the web socket echo request, just echo back the data sent
914
function handleEchoWebSocket(ws, req) {
915
+ if (checkUserIpAddress(ws, req) == false) { return; }
916
+
917
// When data is received from the web socket, echo it back
918
ws.on('message', function (data) {
919
var cmd = data.toString('utf8');
@@ -932,6 +965,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
965
966
// Indicates we want to handle websocket requests on "/control.ashx".
967
function handleControlRequest(ws, req) {
968
+ if (checkUserIpAddress(ws, req) == false) { return; }
969
var domain = getDomain(req);
970
try {
971
// Check if the user is logged in
@@ -1803,6 +1837,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
1837
1838
// Handle a server backup request
1839
function handleBackupRequest(req, res) {
1840
+ if (checkUserIpAddress(req, res) == false) { return; }
1841
var domain = getDomain(req);
1842
if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (obj.parent.args.noserverbackup == 1)) { res.sendStatus(401); return; }
1843
var user = obj.users[req.session.userid];
@@ -1835,6 +1870,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
1870
1871
// Handle a server restore request
1872
function handleRestoreRequest(req, res) {
1873
+ if (checkUserIpAddress(req, res) == false) { return; }
1874
var domain = getDomain(req);
1875
if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (obj.parent.args.noserverbackup == 1)) { res.sendStatus(401); return; }
1876
var user = obj.users[req.session.userid];
@@ -1850,6 +1886,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
1886
1887
// Handle a request to download a mesh agent
1888
obj.handleMeshAgentRequest = function (req, res) {
1889
+ if (checkUserIpAddress(req, res) == false) { return; }
1890
if (req.query.id != null) {
1891
// Send a specific mesh agent back
1892
var argentInfo = obj.parent.meshAgentBinaries[req.query.id];
@@ -1879,6 +1916,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
1916
1917
// Handle a request to download a mesh settings
1918
obj.handleMeshSettingsRequest = function (req, res) {
1919
+ if (checkUserIpAddress(req, res) == false) { return; }
1920
var domain = getDomain(req);
1921
//if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
1922