Server peering fixes.

Ylian Saint-Hilaire committed Nov 12, 2020 at 18:42 UTC a3d712d207078c1e06fd96244405907aa3932f90
2 files changed +11 -9
db.js
+4 -4
@@ -448,7 +448,7 @@ module.exports.CreateDB = function (parent, func) {
448 } else {
449 obj.fileChangeStream = obj.file.watch([{ $match: { $or: [{ 'fullDocument.type': { $in: ['node', 'mesh', 'user', 'ugrp'] } }, { 'operationType': 'delete' }] } }], { fullDocument: 'updateLookup' });
450 obj.fileChangeStream.on('change', function (change) {
451 - if (change.operationType == 'update') {
451 + if ((change.operationType == 'update') || (change.operationType == 'replace')) {
452 switch (change.fullDocument.type) {
453 case 'node': { dbNodeChange(change, false); break; } // A node has changed
454 case 'mesh': { dbMeshChange(change, false); break; } // A device group has changed
@@ -1579,7 +1579,7 @@ module.exports.CreateDB = function (parent, func) {
1579 // Called when a node has changed
1580 function dbNodeChange(nodeChange, added) {
1581 common.unEscapeLinksFieldName(nodeChange.fullDocument);
1582 - const node = nodeChange.fullDocument;
1582 + const node = performTypedRecordDecrypt([nodeChange.fullDocument])[0];
1583 if (node.intelamt != null) { // Remove the Intel AMT password and MPS password before eventing this.
1584 if (node.intelamt.pass != null) { node.intelamt.pass = 1; }
1585 if (node.intelamt.mpspass != null) { node.intelamt.mpspass = 1; }
@@ -1591,7 +1591,7 @@ module.exports.CreateDB = function (parent, func) {
1591 function dbMeshChange(meshChange, added) {
1592 if (parent.webserver == null) return;
1593 common.unEscapeLinksFieldName(meshChange.fullDocument);
1594 - const mesh = meshChange.fullDocument;
1594 + const mesh = performTypedRecordDecrypt([meshChange.fullDocument])[0];
1595
1596 // Update the mesh object in memory
1597 const mmesh = parent.webserver.meshes[mesh._id];
@@ -1613,7 +1613,7 @@ module.exports.CreateDB = function (parent, func) {
1613 // Called when a user account has changed
1614 function dbUserChange(userChange, added) {
1615 if (parent.webserver == null) return;
1616 - const user = userChange.fullDocument;
1616 + const user = performTypedRecordDecrypt([userChange.fullDocument])[0];
1617
1618 // Update the user object in memory
1619 const muser = parent.webserver.users[user._id];
multiserver.js
+7 -5
@@ -624,12 +624,14 @@ module.exports.CreateMultiServer = function (parent, args) {
624 peerTunnel.ws2.on('open', function () {
625 peerTunnel.parent.parent.debug('peer', 'FTunnel ' + peerTunnel.serverid + ': Connected');
626
627 - // Get the peer server's certificate and compute the server public key hash
628 - var serverCert = obj.forge.pki.certificateFromAsn1(obj.forge.asn1.fromDer(peerTunnel.ws2._socket.getPeerCertificate().raw.toString('binary')));
629 - var serverCertHashHex = Buffer.from(obj.forge.pki.getPublicKeyFingerprint(serverCert.publicKey, { encoding: 'binary', md: obj.forge.md.sha384.create() }), 'binary').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
627 + if (peerTunnel.ws2._socket.getPeerCertificate != null) {
628 + // Get the peer server's certificate and compute the server public key hash
629 + var serverCert = obj.forge.pki.certificateFromAsn1(obj.forge.asn1.fromDer(peerTunnel.ws2._socket.getPeerCertificate().raw.toString('binary')));
630 + var serverCertHashHex = Buffer.from(obj.forge.pki.getPublicKeyFingerprint(serverCert.publicKey, { encoding: 'binary', md: obj.forge.md.sha384.create() }), 'binary').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
631
631 - // Check if the peer certificate is the expected one for this serverid
632 - if ((obj.peerServers[serverid] == null) || (obj.peerServers[serverid].serverCertHash != serverCertHashHex)) { console.log('ERROR: Outer certificate hash mismatch (1). (' + peerTunnel.url + ', ' + peerTunnel.serverid + ').'); peerTunnel.close(); return; }
632 + // Check if the peer certificate is the expected one for this serverid
633 + if ((obj.peerServers[serverid] == null) || (obj.peerServers[serverid].serverCertHash != serverCertHashHex)) { console.log('ERROR: Outer certificate hash mismatch (1). (' + peerTunnel.url + ', ' + peerTunnel.serverid + ').'); peerTunnel.close(); return; }
634 + }
635
636 // Connection accepted, resume the web socket to start the data flow
637 peerTunnel.ws1._socket.resume();