Improved Web-SSH, Web-RDP and session logging.
Ylian Saint-Hilaire committed
May 5, 2021 at 00:18 UTC
d17aae0c8f0d78c7afe217b528cbf55fc167bc89
3 files changed
+73
-48
apprelays.js
+46
-41
@@ -21,26 +21,30 @@ module.exports.CreateMstscRelay = function (parent, db, ws, req, args, domain) {
21
const WebSocket = require('ws');
22
23
var obj = {};
24
- obj.domain = domain;
24
obj.ws = ws;
26
- obj.wsClient = null;
27
- obj.tcpServer = null;
25
obj.tcpServerPort = 0;
29
- obj.relaySocket = null;
26
obj.relayActive = false;
31
- obj.infos = null;
27
var rdpClient = null;
28
29
parent.parent.debug('relay', 'RDP: Request for RDP relay (' + req.clientIp + ')');
30
31
// Disconnect
32
obj.close = function (arg) {
33
+ if (obj.ws == null) return;
34
+
35
+ // Collect how many raw bytes where received and sent.
36
+ // We sum both the websocket and TCP client in this case.
37
+ //var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
38
+ //if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
39
+ //console.log('WinRDP - in', inTraffc, 'out', outTraffc);
40
+
41
+ if (obj.wsClient) { obj.wsClient.close(); delete obj.wsClient; }
42
+ if (obj.tcpServer) { obj.tcpServer.close(); obj.tcpServer.destroy(); delete obj.tcpServer; }
43
+ if (rdpClient) { rdpClient.close(); rdpClient = null; }
44
if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (e) { console.log(e); } } // Soft close, close the websocket
45
if (arg == 2) { try { ws._socket._parent.end(); } catch (e) { console.log(e); } } // Hard close, close the TCP socket
40
- if (obj.wsClient) { obj.wsClient.close(); obj.wsClient = null; }
41
- if (obj.tcpServer) { obj.tcpServer.close(); obj.tcpServer = null; }
42
- if (rdpClient) { rdpClient.close(); rdpClient = null; }
43
- delete obj.domain;
46
+ obj.ws.removeAllListeners();
47
+ obj.relayActive = false;
48
delete obj.ws;
49
};
50
@@ -67,11 +71,10 @@ module.exports.CreateMstscRelay = function (parent, db, ws, req, args, domain) {
71
// Setup the correct URL with domain and use TLS only if needed.
72
var options = { rejectUnauthorized: false };
73
if (domain.dns != null) { options.servername = domain.dns; }
70
- var protocol = 'wss';
71
- if (args.tlsoffload) { protocol = 'ws'; }
74
+ var protocol = (args.tlsoffload) ? 'ws' : 'wss';
75
var domainadd = '';
76
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
74
- var url = protocol + '://127.0.0.1:' + args.port + '/' + domainadd + ((cookie.lc == 1)?'local':'mesh') + 'relay.ashx?noping=1&auth=' + obj.infos.ip;
77
+ var url = protocol + '://127.0.0.1:' + args.port + '/' + domainadd + ((cookie.lc == 1) ? 'local' : 'mesh') + 'relay.ashx?noping=1&p=10&auth=' + obj.infos.ip; // Protocol 10 is Web-RDP
78
parent.parent.debug('relay', 'RDP: Connection websocket to ' + url);
79
obj.wsClient = new WebSocket(url, options);
80
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'RDP: Relay websocket open'); });
@@ -170,48 +173,56 @@ module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
173
var obj = new require('stream').Duplex(options);
174
obj.forwardwrite = null;
175
obj.updateBuffer = function (chunk) { this.push(chunk); };
173
- obj._write = function (chunk, encoding, callback) { if (obj.forwardwrite != null) { obj.forwardwrite(chunk); } else { console.err("Failed to fwd _write."); } if (callback) callback(); }; // Pass data written to forward
176
+ obj._write = function (chunk, encoding, callback) { if (obj.forwardwrite != null) { obj.forwardwrite(chunk); } if (callback) callback(); }; // Pass data written to forward
177
obj._read = function (size) { }; // Push nothing, anything to read should be pushed from updateBuffer()
178
+ obj.destroy = function () { delete obj.forwardwrite; }
179
return obj;
180
}
181
182
const obj = {};
179
- obj.domain = domain;
183
obj.ws = ws;
184
obj.relayActive = false;
182
- obj.sshClient = null;
183
- obj.sshShell = null;
184
- obj.termSize = null;
185
- obj.relayActive = false;
186
- obj.wsClient = null;
185
186
parent.parent.debug('relay', 'SSH: Request for SSH relay (' + req.clientIp + ')');
187
188
// Disconnect
189
obj.close = function (arg) {
192
- if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (e) { console.log(e); } } // Soft close, close the websocket
193
- if (arg == 2) { try { ws._socket._parent.end(); } catch (e) { console.log(e); } } // Hard close, close the TCP socket
194
- //if (obj.wsClient) { obj.wsClient.close(); obj.wsClient = null; }
195
- //if (obj.tcpServer) { obj.tcpServer.close(); obj.tcpServer = null; }
196
- //if (sshClient) { sshClient.close(); sshClient = null; }
197
-
198
- if (obj.wsClient != null) {
199
- try { obj.wsClient.close(); } catch (ex) { console.log(ex); }
200
- delete obj.wsClient;
190
+ if (obj.ws == null) return;
191
+
192
+ // Collect how many raw bytes where received and sent.
193
+ // We sum both the websocket and TCP client in this case.
194
+ //var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
195
+ //if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
196
+ //console.log('WinSSH - in', inTraffc, 'out', outTraffc);
197
+
198
+ if (obj.sshShell) {
199
+ obj.sshShell.destroy();
200
+ obj.sshShell.removeAllListeners('data');
201
+ obj.sshShell.removeAllListeners('close');
202
+ try { obj.sshShell.end(); } catch (ex) { console.log(ex); }
203
+ delete obj.sshShell;
204
}
202
- if (obj.sshClient != null) {
205
+ if (obj.sshClient) {
206
+ obj.sshClient.destroy();
207
+ obj.sshClient.removeAllListeners('ready');
208
try { obj.sshClient.end(); } catch (ex) { console.log(ex); }
209
delete obj.sshClient;
210
}
206
- if (obj.sshShell != null) {
207
- try { obj.sshShell.end(); } catch (ex) { console.log(ex); }
208
- delete obj.sshShell;
211
+ if (obj.wsClient) {
212
+ obj.wsClient.removeAllListeners('open');
213
+ obj.wsClient.removeAllListeners('message');
214
+ obj.wsClient.removeAllListeners('close');
215
+ try { obj.wsClient.close(); } catch (ex) { console.log(ex); }
216
+ delete obj.wsClient;
217
}
218
219
+ if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (e) { console.log(e); } } // Soft close, close the websocket
220
+ if (arg == 2) { try { ws._socket._parent.end(); } catch (e) { console.log(e); } } // Hard close, close the TCP socket
221
+ obj.ws.removeAllListeners();
222
+
223
obj.relayActive = false;
224
delete obj.termSize;
225
delete obj.cookie;
214
- delete obj.domain;
226
delete obj.ws;
227
};
228
@@ -229,7 +240,7 @@ module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
240
if (args.tlsoffload) { protocol = 'ws'; }
241
var domainadd = '';
242
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
232
- var url = protocol + '://127.0.0.1:' + args.port + '/' + domainadd + ((obj.cookie.lc == 1) ? 'local' : 'mesh') + 'relay.ashx?noping=1&auth=' + req.query.auth;
243
+ var url = protocol + '://127.0.0.1:' + args.port + '/' + domainadd + ((obj.cookie.lc == 1) ? 'local' : 'mesh') + 'relay.ashx?noping=1&p=11&auth=' + req.query.auth; // Protocol 11 is Web-SSH
244
parent.parent.debug('relay', 'SSH: Connection websocket to ' + url);
245
obj.wsClient = new WebSocket(url, options);
246
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'SSH: Relay websocket open'); });
@@ -306,10 +317,7 @@ module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
317
// Terminal data
318
if (obj.sshShell != null) { obj.sshShell.write(msg.substring(1)); }
319
}
309
- } catch (ex) {
310
- console.log('SSHMessageException', msg, ex);
311
- obj.close();
312
- }
320
+ } catch (ex) { obj.close(); }
321
});
322
323
// If error, do nothing
@@ -317,9 +325,6 @@ module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
325
326
// If the web socket is closed
327
ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
320
-
321
- // Send data on the web socket
322
- //function send(obj) { try { ws.send(JSON.stringify(obj), function () { }); } catch (ex) { } }
328
329
return obj;
330
};
\ No newline at end of file
meshrelay.js
+26
-6
@@ -36,6 +36,17 @@ const MESHRIGHT_RESETOFF = 0x00040000;
36
const MESHRIGHT_GUESTSHARING = 0x00080000;
37
const MESHRIGHT_ADMIN = 0xFFFFFFFF;
38
39
+// Protocol:
40
+// 1 = Terminal
41
+// 2 = Desktop
42
+// 5 = Files
43
+// 10 = Web-RDP
44
+// 11 = Web-SSH
45
+// 12 = Web-VNC
46
+// 100 = Intel AMT WSMAN
47
+// 101 = Intel AMT Redirection
48
+// 200 = Messenger
49
+
50
function checkDeviceSharePublicIdentifier(parent, domain, nodeid, pid, func) {
51
// Check the public id
52
parent.db.GetAllTypeNodeFiltered([nodeid], domain.id, 'deviceshare', null, function (err, docs) {
@@ -1011,15 +1022,24 @@ function CreateLocalRelayEx(parent, ws, req, domain, user, cookie) {
1022
1023
// Disconnect
1024
obj.close = function (arg) {
1014
- if ((arg == 1) || (arg == null)) { try { ws.close(); parent.parent.debug('relay', 'Relay: Soft disconnect'); } catch (e) { console.log(e); } } // Soft close, close the websocket
1015
- if (arg == 2) { try { ws._socket._parent.end(); parent.parent.debug('relay', 'Relay: Hard disconnect'); } catch (e) { console.log(e); } } // Hard close, close the TCP socket
1025
+ // If the web socket is already closed, stop here.
1026
+ if (obj.ws == null) return;
1027
+
1028
+ // Collect how many raw bytes where received and sent.
1029
+ // We sum both the websocket and TCP client in this case.
1030
+ var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
1031
+ if (obj.client != null) { inTraffc += obj.client.bytesRead; outTraffc += obj.client.bytesWritten; }
1032
+
1033
+ // Close the web socket
1034
+ if ((arg == 1) || (arg == null)) { try { obj.ws.close(); parent.parent.debug('relay', 'Relay: Soft disconnect'); } catch (e) { console.log(e); } } // Soft close, close the websocket
1035
+ if (arg == 2) { try { obj.ws._socket._parent.end(); parent.parent.debug('relay', 'Relay: Hard disconnect'); } catch (e) { console.log(e); } } // Hard close, close the TCP socket
1036
1037
// Update the relay session count
1038
if (obj.relaySessionCounted) { parent.relaySessionCount--; delete obj.relaySessionCounted; }
1039
1020
- // Log the disconnection
1040
+ // Log the disconnection, traffic will be credited to the authenticated user
1041
if (obj.time) {
1022
- var event = { etype: 'relay', action: 'relaylog', domain: domain.id, userid: obj.user._id, username: obj.user.name, msgid: 9, msgArgs: [obj.id, obj.req.clientIp, obj.host, Math.floor((Date.now() - obj.time) / 1000)], msg: 'Ended relay session \"' + obj.id + '\" from ' + obj.req.clientIp + ' to ' + obj.host + ', ' + Math.floor((Date.now() - obj.time) / 1000) + ' second(s)', nodeid: obj.req.query.nodeid };
1042
+ var event = { etype: 'relay', action: 'relaylog', domain: domain.id, userid: obj.user._id, username: obj.user.name, msgid: 9, msgArgs: [obj.id, obj.req.clientIp, obj.host, Math.floor((Date.now() - obj.time) / 1000)], msg: 'Ended relay session \"' + obj.id + '\" from ' + obj.req.clientIp + ' to ' + obj.host + ', ' + Math.floor((Date.now() - obj.time) / 1000) + ' second(s)', nodeid: obj.req.query.nodeid, protocol: req.query.p, in: inTraffc, out: outTraffc };
1043
parent.parent.DispatchEvent(['*', user._id], obj, event);
1044
}
1045
@@ -1031,7 +1051,7 @@ function CreateLocalRelayEx(parent, ws, req, domain, user, cookie) {
1051
delete obj.meshid;
1052
delete obj.tcpport;
1053
delete obj.expireTimer;
1034
- if (obj.client != null) { obj.client.destroy(); delete obj.client; }
1054
+ if (obj.client != null) { obj.client.destroy(); delete obj.client; } // Close the client socket
1055
if (obj.pingtimer != null) { clearInterval(obj.pingtimer); delete obj.pingtimer; }
1056
if (obj.pongtimer != null) { clearInterval(obj.pongtimer); delete obj.pongtimer; }
1057
@@ -1066,7 +1086,7 @@ function CreateLocalRelayEx(parent, ws, req, domain, user, cookie) {
1086
obj.client.connect(obj.tcpport, node.host, function () {
1087
// Log the start of the connection
1088
obj.time = Date.now();
1069
- var event = { etype: 'relay', action: 'relaylog', domain: domain.id, userid: obj.user._id, username: obj.user.name, msgid: 13, msgArgs: [obj.id, obj.req.clientIp, obj.host], msg: 'Started relay session \"' + obj.id + '\" from ' + obj.req.clientIp + ' to ' + obj.host, nodeid: req.query.nodeid };
1089
+ var event = { etype: 'relay', action: 'relaylog', domain: domain.id, userid: obj.user._id, username: obj.user.name, msgid: 13, msgArgs: [obj.id, obj.req.clientIp, obj.host], msg: 'Started relay session \"' + obj.id + '\" from ' + obj.req.clientIp + ' to ' + obj.host, nodeid: req.query.nodeid, protocol: req.query.p };
1090
parent.parent.DispatchEvent(['*', obj.user._id, obj.meshid, obj.nodeid], obj, event);
1091
1092
// Start the session
public/novnc/core/rfb.js
+1
-1
@@ -397,7 +397,7 @@ export default class RFB extends EventTargetMixin {
397
398
try {
399
// WebSocket.onopen transitions to the RFB init states
400
- this._sock.open(this._url, ['binary']);
400
+ this._sock.open(this._url + '&p=12', ['binary']);
401
} catch (e) {
402
if (e.name === 'SyntaxError') {
403
this._fail("Invalid host or port (" + e + ")");