fix: AMT Direct TLS connection and Digest authentication - fix: ensure TLS is used when TLS is enabled - add constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION for TLS client connection for newer Nodejs - ensure nc of AMT redirection Digest authentication to have at 8 bytes length
fix: AMT Direct TLS connection and Digest authentication - fix: ensure TLS is used when TLS is enabled - add constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION for TLS client connection for newer Nodejs - ensure nc of AMT redirection Digest authentication to have at 8 bytes length
Joko Sastriawan committed
Nov 15, 2022 at 14:12 UTC
b5338b746af68af6d0660a97ecceff41b7c8214d
4 files changed
+14
-4
interceptor.js
+1
-1
@@ -395,7 +395,7 @@ module.exports.CreateRedirInterceptor = function (args) {
395
if (obj.amt.digestRealm) {
396
// Replace this authentication digest with a server created one
397
// We have everything we need to authenticate
398
- var nc = obj.ws.authCNonceCount;
398
+ var nc = '0'+ (10000000 + obj.ws.authCNonceCount).toString().substring(1);// set NC at least 8 bytes
399
obj.ws.authCNonceCount++;
400
var digest = obj.ComputeDigesthash(obj.args.user, obj.args.pass, obj.amt.digestRealm, 'POST', authurl, obj.amt.digestQOP, obj.amt.digestNonce, nc, obj.ws.authCNonce);
401
views/default-mobile.handlebars
+6
-1
@@ -4173,7 +4173,12 @@
4173
desktop.m.useZRLE = (desktopsettings.encoding < 3);
4174
desktop.m.showmouse = true;
4175
desktop.m.onScreenSizeChange = function (o, x, y) { if (fullscreen) { QS('deskarea3').width = (x * fullscreenzoom) + 'px'; QS('deskarea3').height = (y * fullscreenzoom) + 'px'; } deskAdjust(); }
4176
- desktop.Start(desktopNode._id, 16994, '*', '*', 0);
4176
+ // Use TLS if TLS is set
4177
+ if (desktopNode.conn==4 && desktopNode.intelamt!=null && desktopNode.intelamt.tls==1) {
4178
+ desktop.Start(desktopNode._id, 16995, '*', '*', 1);
4179
+ } else {
4180
+ desktop.Start(desktopNode._id, 16994, '*', '*', 0);
4181
+ }
4182
desktop.contype = 2;
4183
} else if ((contype == null) || (contype == 1) || ((contype == 3) && (currentNode.agent.id > 4))) {
4184
// Setup the Mesh Agent remote desktop
views/default.handlebars
+6
-1
@@ -8904,7 +8904,12 @@
8904
}
8905
}
8906
};
8907
- desktop.Start(desktopNode._id, 16994, '*', '*', 0);
8907
+ // Use TLS if TLS is set
8908
+ if (desktopNode.conn==4 && desktopNode.intelamt!=null && desktopNode.intelamt.tls==1) {
8909
+ desktop.Start(desktopNode._id, 16995, '*', '*', 1);
8910
+ } else {
8911
+ desktop.Start(desktopNode._id, 16994, '*', '*', 0);
8912
+ }
8913
desktop.contype = 2;
8914
} else if ((contype == null) || (contype == 1) || ((contype == 3) && ((currentNode.agent.id > 4) && ((debugmode == null))))) {
8915
// Setup the Mesh Agent remote desktop
webserver.js
+1
-1
@@ -4826,7 +4826,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
4826
ws._socket.resume();
4827
} else {
4828
// If TLS is going to be used, setup a TLS socket
4829
- var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
4829
+ var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
4830
if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
4831
ws.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () {
4832
// The TLS connection method is the same as TCP, but located a bit differently.