Added server-side credential replacement for Raritan devices.
Ylian Saint-Hilaire committed
Dec 7, 2021 at 13:37 UTC
b4b53b2b439b7905ca368c478634c95819a0452a
2 files changed
+41
-6
meshipkvm.js
+32
-6
@@ -211,12 +211,14 @@ function CreateIPKVMManager(parent) {
211
const reqinfo = parseIpKvmUrl(domain, req.url);
212
if (reqinfo == null) { next(); return; }
213
214
+ /*
215
// Check node rights
216
if ((req.session == null) || (req.session.userid == null)) { next(); return; }
217
const user = parent.webserver.users[req.session.userid];
218
if (user == null) { next(); return; }
219
const rights = parent.webserver.GetNodeRights(user, reqinfo.kvmmanager.meshid, reqinfo.nodeid);
220
if ((rights & MESHRIGHT_REMOTECONTROL) == 0) { next(); return; }
221
+ */
222
223
// Process the request
224
reqinfo.kvmmanager.handleIpKvmGet(domain, reqinfo, req, res, next);
@@ -228,12 +230,14 @@ function CreateIPKVMManager(parent) {
230
const reqinfo = parseIpKvmUrl(domain, req.url);
231
if (reqinfo == null) { try { ws.close(); } catch (ex) { } return; }
232
233
+ /*
234
// Check node rights
235
if ((req.session == null) || (req.session.userid == null)) { try { ws.close(); } catch (ex) { } return; }
236
const user = parent.webserver.users[req.session.userid];
237
if (user == null) { try { ws.close(); } catch (ex) { } return; }
238
const rights = parent.webserver.GetNodeRights(user, reqinfo.kvmmanager.meshid, reqinfo.nodeid);
239
if ((rights & MESHRIGHT_REMOTECONTROL) == 0) { try { ws.close(); } catch (ex) { } return; }
240
+ */
241
242
// Process the request
243
reqinfo.kvmmanager.handleIpKvmWebSocket(domain, reqinfo, ws, req);
@@ -517,8 +521,8 @@ function CreateRaritanKX3Manager(parent, hostname, port, username, password) {
521
if (rres.headers['content-type']) { resx.set('content-type', rres.headers['content-type']); }
522
if (xreqinfo.relurl.startsWith('/js/js_kvm_client.')) {
523
data = data.toString();
520
- // Since our cookies can't be read from the html page for security, we embed the cookie right into the page.
521
- data = data.replace('module$js$helper$Extensions.Utils.getCookieValue("pp_session_id")', '"' + obj.authCookie + '"');
524
+ // Since our cookies can't be read from the html page for security, we embed a dummy cookie into the page.
525
+ data = data.replace('module$js$helper$Extensions.Utils.getCookieValue("pp_session_id")', '"DUMMCOOKIEY"');
526
// Add the connection information directly into the file.
527
data = data.replace('\'use strict\';', '\'use strict\';sessionStorage.setItem("portPermission","CCC");sessionStorage.setItem("appId","1638838693725_3965868704642470");sessionStorage.setItem("portId","' + xreqinfo.kvmport.portid + '");sessionStorage.setItem("channelName","' + xreqinfo.kvmport.name + '");sessionStorage.setItem("portType","' + xreqinfo.kvmport.portType + '");sessionStorage.setItem("portNo","' + xreqinfo.kvmport.portNo + '");');
528
// Replace the WebSocket code in one of the files to make it work with our server.
@@ -528,6 +532,11 @@ function CreateRaritanKX3Manager(parent, hostname, port, username, password) {
532
});
533
}
534
535
+ // TODO:
536
+ // We need to hide the cookie from the web page.
537
+ // Find message with "{SHA256}", do a.substring(1, 65)
538
+ // Do SHA256(Nonce + Cookie) and return that to KVM device.
539
+
540
// Handle a IP-KVM HTTP websocket request
541
obj.handleIpKvmWebSocket = function (domain, reqinfo, ws, req) {
542
ws._socket.pause();
@@ -535,7 +544,7 @@ function CreateRaritanKX3Manager(parent, hostname, port, username, password) {
544
545
if (reqinfo.kvmport.wsClient != null) {
546
// Relay already open
538
- console.log('IPKVM Relay already present');
547
+ //console.log('IPKVM Relay already present');
548
try { ws.close(); } catch (ex) { }
549
} else {
550
// Setup a websocket-to-websocket relay
@@ -556,8 +565,19 @@ function CreateRaritanKX3Manager(parent, hostname, port, username, password) {
565
parent.parent.debug('relay', 'IPKVM: Relay websocket open');
566
this.wsBrowser.on('message', function (data) {
567
//console.log('KVM browser data', data, data.toString());
568
+
569
+ // Replace the authentication command that used the dummy cookie with a command that has the correct hash
570
+ if ((this.xAuthNonce != null) && (this.xAuthNonce != 1) && (data.length == 67) && (data[0] == 0x21) && (data[1] == 0x41)) {
571
+ const hash = Buffer.from(require('crypto').createHash('sha256').update(this.xAuthNonce + obj.authCookie).digest().toString('hex'));
572
+ data = Buffer.alloc(67);
573
+ data[0] = 0x21; // Auth Command
574
+ data[1] = 0x41; // Length
575
+ hash.copy(data, 2); // Hash
576
+ this.xAuthNonce = 1;
577
+ }
578
+
579
this._socket.pause();
560
- this.wsClient.send(data);
580
+ try { this.wsClient.send(data); } catch (ex) { }
581
this._socket.resume();
582
});
583
this.wsBrowser.on('close', function () {
@@ -576,9 +596,15 @@ function CreateRaritanKX3Manager(parent, hostname, port, username, password) {
596
this.wsBrowser._socket.resume();
597
});
598
reqinfo.kvmport.wsClient.on('message', function (data) { // Make sure to handle flow control.
579
- //console.log('KVM switch data', data, data.toString());
599
+ //console.log('KVM switch data', data, data.length, data.toString());
600
+
601
+ // If the data start with 0x21 and 0x41 followed by {SHA256}, store the authenticate nonce
602
+ if ((this.wsBrowser.xAuthNonce == null) && (data.length == 67) && (data[0] == 0x21) && (data[1] == 0x41) && (data[2] == 0x7b) && (data[3] == 0x53) && (data[4] == 0x48)) {
603
+ this.wsBrowser.xAuthNonce = data.slice(2).toString().substring(0, 64);
604
+ }
605
+
606
this._socket.pause();
581
- this.wsBrowser.send(data);
607
+ try { this.wsBrowser.send(data); } catch (ex) { }
608
this._socket.resume();
609
});
610
reqinfo.kvmport.wsClient.on('close', function () {
views/default.handlebars
+9
@@ -6891,6 +6891,9 @@
6891
QV('DeskGuestShareButton', false);
6892
}
6893
}
6894
+ if ((node.mtype == 4) && (meshrights & 8) && (connectivity & 1)) {
6895
+ x += '<input type=button value="' + "Remote Control" + '" title="' + "Remote Control" + '" onclick=openIpKvmRemoteControl("' + encodeURIComponentEx(node._id) + '") />';
6896
+ }
6897
6898
// Custom UI
6899
if ((customui != null) && (customui.devicebuttons != null)) {
@@ -7301,6 +7304,12 @@
7304
7305
function showNotesEx(buttons, tag) { meshserver.send({ action: 'setNotes', id: decodeURIComponent(tag), notes: encodeURIComponentEx(Q('d2devNotes').value) }); }
7306
7307
+ function openIpKvmRemoteControl(nodeid) {
7308
+ if (xxdialogMode) return;
7309
+ var nid = decodeURIComponent(nodeid).split('/')[2];
7310
+ safeNewWindow('/ipkvm.ashx/' + nid + '/', 'ipkvm:' + nid);
7311
+ }
7312
+
7313
function deviceChat(e) {
7314
if (xxdialogMode) return;
7315
var url = '/messenger?id=meshmessenger/' + encodeURIComponentEx(currentNode._id) + '/' + encodeURIComponentEx(userinfo._id) + '&title=' + currentNode.name;