Server peering fixes.
Ylian Saint-Hilaire committed
Nov 12, 2020 at 18:42 UTC
a3d712d207078c1e06fd96244405907aa3932f90
2 files changed
+11
-9
db.js
+4
-4
@@ -448,7 +448,7 @@ module.exports.CreateDB = function (parent, func) {
448
} else {
449
obj.fileChangeStream = obj.file.watch([{ $match: { $or: [{ 'fullDocument.type': { $in: ['node', 'mesh', 'user', 'ugrp'] } }, { 'operationType': 'delete' }] } }], { fullDocument: 'updateLookup' });
450
obj.fileChangeStream.on('change', function (change) {
451
- if (change.operationType == 'update') {
451
+ if ((change.operationType == 'update') || (change.operationType == 'replace')) {
452
switch (change.fullDocument.type) {
453
case 'node': { dbNodeChange(change, false); break; } // A node has changed
454
case 'mesh': { dbMeshChange(change, false); break; } // A device group has changed
@@ -1579,7 +1579,7 @@ module.exports.CreateDB = function (parent, func) {
1579
// Called when a node has changed
1580
function dbNodeChange(nodeChange, added) {
1581
common.unEscapeLinksFieldName(nodeChange.fullDocument);
1582
- const node = nodeChange.fullDocument;
1582
+ const node = performTypedRecordDecrypt([nodeChange.fullDocument])[0];
1583
if (node.intelamt != null) { // Remove the Intel AMT password and MPS password before eventing this.
1584
if (node.intelamt.pass != null) { node.intelamt.pass = 1; }
1585
if (node.intelamt.mpspass != null) { node.intelamt.mpspass = 1; }
@@ -1591,7 +1591,7 @@ module.exports.CreateDB = function (parent, func) {
1591
function dbMeshChange(meshChange, added) {
1592
if (parent.webserver == null) return;
1593
common.unEscapeLinksFieldName(meshChange.fullDocument);
1594
- const mesh = meshChange.fullDocument;
1594
+ const mesh = performTypedRecordDecrypt([meshChange.fullDocument])[0];
1595
1596
// Update the mesh object in memory
1597
const mmesh = parent.webserver.meshes[mesh._id];
@@ -1613,7 +1613,7 @@ module.exports.CreateDB = function (parent, func) {
1613
// Called when a user account has changed
1614
function dbUserChange(userChange, added) {
1615
if (parent.webserver == null) return;
1616
- const user = userChange.fullDocument;
1616
+ const user = performTypedRecordDecrypt([userChange.fullDocument])[0];
1617
1618
// Update the user object in memory
1619
const muser = parent.webserver.users[user._id];
multiserver.js
+7
-5
@@ -624,12 +624,14 @@ module.exports.CreateMultiServer = function (parent, args) {
624
peerTunnel.ws2.on('open', function () {
625
peerTunnel.parent.parent.debug('peer', 'FTunnel ' + peerTunnel.serverid + ': Connected');
626
627
- // Get the peer server's certificate and compute the server public key hash
628
- var serverCert = obj.forge.pki.certificateFromAsn1(obj.forge.asn1.fromDer(peerTunnel.ws2._socket.getPeerCertificate().raw.toString('binary')));
629
- var serverCertHashHex = Buffer.from(obj.forge.pki.getPublicKeyFingerprint(serverCert.publicKey, { encoding: 'binary', md: obj.forge.md.sha384.create() }), 'binary').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
627
+ if (peerTunnel.ws2._socket.getPeerCertificate != null) {
628
+ // Get the peer server's certificate and compute the server public key hash
629
+ var serverCert = obj.forge.pki.certificateFromAsn1(obj.forge.asn1.fromDer(peerTunnel.ws2._socket.getPeerCertificate().raw.toString('binary')));
630
+ var serverCertHashHex = Buffer.from(obj.forge.pki.getPublicKeyFingerprint(serverCert.publicKey, { encoding: 'binary', md: obj.forge.md.sha384.create() }), 'binary').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
631
631
- // Check if the peer certificate is the expected one for this serverid
632
- if ((obj.peerServers[serverid] == null) || (obj.peerServers[serverid].serverCertHash != serverCertHashHex)) { console.log('ERROR: Outer certificate hash mismatch (1). (' + peerTunnel.url + ', ' + peerTunnel.serverid + ').'); peerTunnel.close(); return; }
632
+ // Check if the peer certificate is the expected one for this serverid
633
+ if ((obj.peerServers[serverid] == null) || (obj.peerServers[serverid].serverCertHash != serverCertHashHex)) { console.log('ERROR: Outer certificate hash mismatch (1). (' + peerTunnel.url + ', ' + peerTunnel.serverid + ').'); peerTunnel.close(); return; }
634
+ }
635
636
// Connection accepted, resume the web socket to start the data flow
637
peerTunnel.ws1._socket.resume();