Fixed ClickOnce support & improved websocket authentication
Ylian Saint-Hilaire committed
Oct 15, 2018 at 17:21 UTC
fc03f1ce1dbb25d250b2ea6f8f3435e7da8438d0
12 files changed
+87
-123
meshcentral.js
+4
-3
@@ -1055,7 +1055,8 @@ function CreateMeshCentralServer(config, args) {
1055
o.time = Math.floor(Date.now() / 1000); // Add the cookie creation time
1056
var iv = new Buffer(obj.crypto.randomBytes(12), 'binary'), cipher = obj.crypto.createCipheriv('aes-256-gcm', key, iv);
1057
var crypted = Buffer.concat([cipher.update(JSON.stringify(o), 'utf8'), cipher.final()]);
1058
- return Buffer.concat([iv, cipher.getAuthTag(), crypted]).toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
1058
+ var cookie = Buffer.concat([iv, cipher.getAuthTag(), crypted]).toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
1059
+ return cookie;
1060
} catch (e) { return null; }
1061
};
1062
@@ -1067,11 +1068,11 @@ function CreateMeshCentralServer(config, args) {
1068
var decipher = obj.crypto.createDecipheriv('aes-256-gcm', key, cookie.slice(0, 12));
1069
decipher.setAuthTag(cookie.slice(12, 16));
1070
var o = JSON.parse(decipher.update(cookie.slice(28), 'binary', 'utf8') + decipher.final('utf8'));
1070
- if ((o.time == null) || (o.time == null) || (typeof o.time != 'number')) { return null; }
1071
+ if ((o.time == null) || (o.time == null) || (typeof o.time != 'number')) { Debug(1, 'ERR: Bad cookie due to invalid time'); return null; }
1072
o.time = o.time * 1000; // Decode the cookie creation time
1073
o.dtime = Date.now() - o.time; // Decode how long ago the cookie was created (in milliseconds)
1074
if (timeout == null) { timeout = 2; }
1074
- if ((o.dtime > (timeout * 60000)) || (o.dtime < -30000)) return null; // The cookie is only valid 120 seconds, or 30 seconds back in time (in case other server's clock is not quite right)
1075
+ if ((o.dtime > (timeout * 60000)) || (o.dtime < -30000)) { Debug(1, 'ERR: Bad cookie due to timeout'); return null; } // The cookie is only valid 120 seconds, or 30 seconds back in time (in case other server's clock is not quite right)
1076
return o;
1077
} catch (e) { return null; }
1078
};
meshrelay.js
+21
-43
@@ -13,11 +13,13 @@
13
/*jshint esversion: 6 */
14
"use strict";
15
16
-module.exports.CreateMeshRelay = function (parent, ws, req, domain) {
16
+module.exports.CreateMeshRelay = function (parent, ws, req, domain, user, cookie) {
17
var obj = {};
18
obj.ws = ws;
19
obj.req = req;
20
obj.peer = null;
21
+ obj.user = user;
22
+ obj.cookie = cookie;
23
obj.parent = parent;
24
obj.id = req.query.id;
25
obj.remoteaddr = obj.ws._socket.remoteAddress;
@@ -69,49 +71,25 @@ module.exports.CreateMeshRelay = function (parent, ws, req, domain) {
71
return false;
72
};
73
72
- if (req.query.auth == null) {
73
- // Use ExpressJS session, check if this session is a logged in user, at least one of the two connections will need to be authenticated.
74
- try { if ((req.session) && (req.session.userid) || (req.session.domainid == obj.domain.id)) { obj.authenticated = true; } } catch (e) { }
75
- if ((obj.authenticated != true) && (req.query.user != null) && (req.query.pass != null)) {
76
- // Check user authentication
77
- obj.parent.authenticate(req.query.user, req.query.pass, obj.domain, function (err, userid, passhint) {
78
- if (userid != null) {
79
- obj.authenticated = true;
80
- // Check if we have agent routing instructions, process this here.
81
- if ((req.query.nodeid != null) && (req.query.tcpport != null)) {
82
- if (obj.id == undefined) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
83
- var command = { nodeid: req.query.nodeid, action: 'msg', type: 'tunnel', value: '*/meshrelay.ashx?id=' + obj.id, tcpport: req.query.tcpport, tcpaddr: ((req.query.tcpaddr == null) ? '127.0.0.1' : req.query.tcpaddr) };
84
- if (obj.sendAgentMessage(command, userid, obj.domain.id) == false) { obj.id = null; obj.parent.parent.debug(1, 'Relay: Unable to contact this agent (' + obj.remoteaddr + ')'); }
85
- }
86
- } else {
87
- obj.parent.parent.debug(1, 'Relay: User authentication failed (' + obj.remoteaddr + ')');
88
- obj.ws.send('error:Authentication failed');
89
- }
90
- performRelay();
91
- });
92
- } else {
93
- performRelay();
94
- }
95
- } else {
96
- // Get the session from the cookie
97
- var cookie = obj.parent.parent.decodeCookie(req.query.auth);
98
- if (cookie != null) {
99
- obj.authenticated = true;
100
- if (cookie.tcpport != null) {
101
- // This cookie has agent routing instructions, process this here.
102
- if (obj.id == undefined) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
103
- // Send connection request to agent
104
- var command = { nodeid: cookie.nodeid, action: 'msg', type: 'tunnel', value: '*/meshrelay.ashx?id=' + obj.id, tcpport: cookie.tcpport, tcpaddr: cookie.tcpaddr };
105
- if (obj.sendAgentMessage(command, cookie.userid, cookie.domainid) == false) { obj.id = null; obj.parent.parent.debug(1, 'Relay: Unable to contact this agent (' + obj.remoteaddr + ')'); }
106
- }
107
- } else {
108
- obj.id = null;
109
- obj.parent.parent.debug(1, 'Relay: invalid cookie (' + obj.remoteaddr + ')');
110
- obj.ws.send('error:Invalid cookie');
111
- }
112
- performRelay();
74
+ // Mark this relay session as authenticated if this is the user end.
75
+ obj.authenticated = (obj.user != null);
76
+
77
+ // Kick off the routing, if we have agent routing instructions, process them here.
78
+ if ((obj.cookie != null) && (obj.cookie.nodeid != null) && (obj.cookie.tcpport != null) && (obj.cookie.domainid != null)) {
79
+ // We have routing instructions in the cookie, Send connection request to agent
80
+ if (obj.id == undefined) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
81
+ var command = { nodeid: obj.cookie.nodeid, action: 'msg', type: 'tunnel', value: '*/meshrelay.ashx?id=' + obj.id, tcpport: obj.cookie.tcpport, tcpaddr: obj.cookie.tcpaddr };
82
+ obj.parent.parent.debug(1, 'Relay: Sending agent tunnel command: ' + JSON.stringify(command));
83
+ if (obj.sendAgentMessage(command, obj.cookie.userid, obj.cookie.domainid) == false) { obj.id = null; obj.parent.parent.debug(1, 'Relay: Unable to contact this agent (' + obj.remoteaddr + ')'); }
84
+ } else if ((req.query.nodeid != null) && (req.query.tcpport != null)) {
85
+ // We have routing instructions in the URL arguments, Send connection request to agent
86
+ if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
87
+ var command = { nodeid: req.query.nodeid, action: 'msg', type: 'tunnel', value: '*/meshrelay.ashx?id=' + obj.id, tcpport: req.query.tcpport, tcpaddr: ((req.query.tcpaddr == null) ? '127.0.0.1' : req.query.tcpaddr) };
88
+ obj.parent.parent.debug(1, 'Relay: Sending agent tunnel command: ' + JSON.stringify(command));
89
+ if (obj.sendAgentMessage(command, userid, obj.domain.id) == false) { obj.id = null; obj.parent.parent.debug(1, 'Relay: Unable to contact this agent (' + obj.remoteaddr + ')'); }
90
}
114
-
91
+ performRelay();
92
+
93
function performRelay() {
94
if (obj.id == null) { try { obj.close(); } catch (e) { } return null; } // Attempt to connect without id, drop this.
95
ws._socket.setKeepAlive(true, 240000); // Set TCP keep alive
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.2.2-e",
3
+ "version": "0.2.2-f",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_17/MeshMiniRouter.application
renamed
+4
-4
@@ -1,20 +1,20 @@
1
<?xml version="1.0" encoding="utf-8"?>
2
<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">
3
- <assemblyIdentity name="MeshMiniRouter.application" version="2.0.0.16" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />
3
+ <assemblyIdentity name="MeshMiniRouter.application" version="2.0.0.17" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />
4
<description asmv2:publisher="Meshcentral.com" asmv2:product="MeshCentral Mini-Router" asmv2:supportUrl="https://meshcentral.com/" xmlns="urn:schemas-microsoft-com:asm.v1" />
5
<deployment install="false" mapFileExtensions="true" trustURLParameters="true" />
6
<compatibleFrameworks xmlns="urn:schemas-microsoft-com:clickonce.v2">
7
<framework targetVersion="4.5" profile="Full" supportedRuntime="4.0.30319" />
8
</compatibleFrameworks>
9
<dependency>
10
- <dependentAssembly dependencyType="install" codebase="Application Files\MeshMiniRouter_2_0_0_16\MeshMiniRouter.exe.manifest" size="4712">
11
- <assemblyIdentity name="MeshMiniRouter.exe" version="2.0.0.16" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />
10
+ <dependentAssembly dependencyType="install" codebase="Application Files\MeshMiniRouter_2_0_0_17\MeshMiniRouter.exe.manifest" size="4712">
11
+ <assemblyIdentity name="MeshMiniRouter.exe" version="2.0.0.17" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />
12
<hash>
13
<dsig:Transforms>
14
<dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
15
</dsig:Transforms>
16
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
17
- <dsig:DigestValue>uaxqCrqKPjDkZMXMlJ9pIvARsSxYXXLci7n8z3Q8hUU=</dsig:DigestValue>
17
+ <dsig:DigestValue>nyBHr6mVUVhjU6l4Bmrfa0juzDDrPD6BiiYzVMhKKVA=</dsig:DigestValue>
18
</hash>
19
</dependentAssembly>
20
</dependency>
public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_17/MeshMiniRouter.exe.config.deploy
renamed
public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_17/MeshMiniRouter.exe.deploy
renamed
Binary files a/public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_16/MeshMiniRouter.exe.deploy and b/public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_17/MeshMiniRouter.exe.deploy differ
public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_17/MeshMiniRouter.exe.manifest
renamed
+5
-5
@@ -1,10 +1,10 @@
1
<?xml version="1.0" encoding="utf-8"?>
2
<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">
3
- <asmv1:assemblyIdentity name="MeshMiniRouter.exe" version="2.0.0.16" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />
3
+ <asmv1:assemblyIdentity name="MeshMiniRouter.exe" version="2.0.0.17" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />
4
<description asmv2:iconFile="MeshMiniRouter.ico" xmlns="urn:schemas-microsoft-com:asm.v1" />
5
<application />
6
<entryPoint>
7
- <assemblyIdentity name="MeshMiniRouter" version="1.0.6667.26398" language="neutral" processorArchitecture="msil" />
7
+ <assemblyIdentity name="MeshMiniRouter" version="1.0.6862.31040" language="neutral" processorArchitecture="msil" />
8
<commandLine file="MeshMiniRouter.exe" parameters="" />
9
</entryPoint>
10
<trustInfo>
@@ -43,14 +43,14 @@
43
</dependentAssembly>
44
</dependency>
45
<dependency>
46
- <dependentAssembly dependencyType="install" allowDelayedBinding="true" codebase="MeshMiniRouter.exe" size="193536">
47
- <assemblyIdentity name="MeshMiniRouter" version="1.0.6667.26398" language="neutral" processorArchitecture="msil" />
46
+ <dependentAssembly dependencyType="install" allowDelayedBinding="true" codebase="MeshMiniRouter.exe" size="186368">
47
+ <assemblyIdentity name="MeshMiniRouter" version="1.0.6862.31040" language="neutral" processorArchitecture="msil" />
48
<hash>
49
<dsig:Transforms>
50
<dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
51
</dsig:Transforms>
52
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
53
- <dsig:DigestValue>2K6tEre6rIjqc6bZn7uhWlXLgAnZ82UP3jYzxNJ7WIk=</dsig:DigestValue>
53
+ <dsig:DigestValue>H+qrBKAsVVx/APIHP2Tq2cK3/FUh4SIShsjM6eo0fUw=</dsig:DigestValue>
54
</hash>
55
</dependentAssembly>
56
</dependency>
public/clickonce/minirouter/Application Files/MeshMiniRouter_2_0_0_17/MeshMiniRouter.ico.deploy
renamed
public/clickonce/minirouter/MeshMiniRouter.application
+4
-4
@@ -1,20 +1,20 @@
1
<?xml version="1.0" encoding="utf-8"?>
2
<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">
3
- <assemblyIdentity name="MeshMiniRouter.application" version="2.0.0.16" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />
3
+ <assemblyIdentity name="MeshMiniRouter.application" version="2.0.0.17" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />
4
<description asmv2:publisher="Meshcentral.com" asmv2:product="MeshCentral Mini-Router" asmv2:supportUrl="https://meshcentral.com/" xmlns="urn:schemas-microsoft-com:asm.v1" />
5
<deployment install="false" mapFileExtensions="true" trustURLParameters="true" />
6
<compatibleFrameworks xmlns="urn:schemas-microsoft-com:clickonce.v2">
7
<framework targetVersion="4.5" profile="Full" supportedRuntime="4.0.30319" />
8
</compatibleFrameworks>
9
<dependency>
10
- <dependentAssembly dependencyType="install" codebase="Application Files\MeshMiniRouter_2_0_0_16\MeshMiniRouter.exe.manifest" size="4712">
11
- <assemblyIdentity name="MeshMiniRouter.exe" version="2.0.0.16" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />
10
+ <dependentAssembly dependencyType="install" codebase="Application Files\MeshMiniRouter_2_0_0_17\MeshMiniRouter.exe.manifest" size="4712">
11
+ <assemblyIdentity name="MeshMiniRouter.exe" version="2.0.0.17" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />
12
<hash>
13
<dsig:Transforms>
14
<dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
15
</dsig:Transforms>
16
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
17
- <dsig:DigestValue>uaxqCrqKPjDkZMXMlJ9pIvARsSxYXXLci7n8z3Q8hUU=</dsig:DigestValue>
17
+ <dsig:DigestValue>nyBHr6mVUVhjU6l4Bmrfa0juzDDrPD6BiiYzVMhKKVA=</dsig:DigestValue>
18
</hash>
19
</dependentAssembly>
20
</dependency>
public/clickonce/minirouter/publish.htm
+1
-1
@@ -59,7 +59,7 @@ FONT.key {font-weight: bold; color: darkgreen}
59
<TR><TD ALIGN="LEFT"><TABLE CELLPADDING="2" CELLSPACING="0" BORDER="0" WIDTH="540"><TR><TD WIDTH="496">
60
61
<!-- Begin AppInfo -->
62
-<TABLE><TR><TD COLSPAN="3"> </TD></TR><TR><TD><B>Name:</B></TD><TD WIDTH="5"><SPACER TYPE="block" WIDTH="10" /></TD><TD>MeshCentral Mini-Router</TD></TR><TR><TD COLSPAN="3"> </TD></TR><TR><TD><B>Version:</B></TD><TD WIDTH="5"><SPACER TYPE="block" WIDTH="10" /></TD><TD>2.0.0.16</TD></TR><TR><TD COLSPAN="3"> </TD></TR><TR><TD><B>Publisher:</B></TD><TD WIDTH="5"><SPACER TYPE="block" WIDTH="10" /></TD><TD>Meshcentral.com</TD></TR><tr><td colspan="3"> </td></tr></TABLE>
62
+<TABLE><TR><TD COLSPAN="3"> </TD></TR><TR><TD><B>Name:</B></TD><TD WIDTH="5"><SPACER TYPE="block" WIDTH="10" /></TD><TD>MeshCentral Mini-Router</TD></TR><TR><TD COLSPAN="3"> </TD></TR><TR><TD><B>Version:</B></TD><TD WIDTH="5"><SPACER TYPE="block" WIDTH="10" /></TD><TD>2.0.0.17</TD></TR><TR><TD COLSPAN="3"> </TD></TR><TR><TD><B>Publisher:</B></TD><TD WIDTH="5"><SPACER TYPE="block" WIDTH="10" /></TD><TD>Meshcentral.com</TD></TR><tr><td colspan="3"> </td></tr></TABLE>
63
<!-- End AppInfo -->
64
65
views/default.handlebars
+1
-1
@@ -1271,7 +1271,7 @@
1271
case 'getcookie': {
1272
if (message.tag == 'clickonce') {
1273
var basicPort = "{{{serverRedirPort}}}"==""?"{{{serverPublicPort}}}":"{{{serverRedirPort}}}";
1274
- rdpurl = "http://" + window.location.hostname + ":" + basicPort + "/clickonce/minirouter/MeshMiniRouter.application?WS=wss%3A%2F%2F" + window.location.hostname + "%2Fmeshrelay.ashx%3Fauth=" + message.cookie + "&CH={{{webcerthash}}}&AP=" + message.protocol + "&HOL=1";
1274
+ var rdpurl = "http://" + window.location.hostname + ":" + basicPort + "/clickonce/minirouter/MeshMiniRouter.application?WS=wss%3A%2F%2F" + window.location.hostname + "%2Fmeshrelay.ashx%3Fauth=" + message.cookie + "&CH={{{webcerthash}}}&AP=" + message.protocol + "&HOL=1";
1275
window.open(rdpurl, '_blank');
1276
}
1277
break;
webserver.js
+46
-61
@@ -1059,26 +1059,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1059
};
1060
1061
// Handle a web socket relay request
1062
- function handleRelayWebSocket(ws, req) {
1063
- var domain = checkUserIpAddress(ws, req);
1064
- if (domain == null) return;
1065
- // Check if this is a logged in user
1066
- var user, peering = true;
1067
- if (req.query.auth == null) {
1068
- // Use ExpressJS session
1069
- if (!req.session || !req.session.userid) { return; } // Web socket attempt without login, disconnect.
1070
- if (req.session.domainid != domain.id) { console.log('ERR: Invalid domain'); return; }
1071
- user = obj.users[req.session.userid];
1072
- } else {
1073
- // Get the session from the cookie
1074
- if (obj.parent.multiServer == null) { return; }
1075
- var session = obj.parent.decodeCookie(req.query.auth);
1076
- if (session == null) { console.log('ERR: Invalid cookie'); return; }
1077
- if (session.domainid != domain.id) { console.log('ERR: Invalid domain'); return; }
1078
- user = obj.users[session.userid];
1079
- peering = false; // Don't allow the connection to jump again to a different server
1080
- }
1081
- if (!user) { console.log('ERR: Not a user'); return; }
1062
+ function handleRelayWebSocket(ws, req, domain, user, cookie) {
1063
+ if (!(req.query.host)) { console.log('ERR: No host target specified'); try { ws.close(); } catch (e) { } return; } // Disconnect websocket
1064
Debug(1, 'Websocket relay connected from ' + user.name + ' for ' + req.query.host + '.');
1065
1066
ws.pause(); // Hold this socket until we are ready.
@@ -1086,13 +1068,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1068
1069
// Fetch information about the target
1070
obj.db.Get(req.query.host, function (err, docs) {
1089
- if (docs.length == 0) { console.log('ERR: Node not found'); return; }
1071
+ if (docs.length == 0) { console.log('ERR: Node not found'); try { ws.close(); } catch (e) { } return; } // Disconnect websocket
1072
var node = docs[0];
1091
- if (!node.intelamt) { console.log('ERR: Not AMT node'); return; }
1073
+ if (!node.intelamt) { console.log('ERR: Not AMT node'); try { ws.close(); } catch (e) { } return; } // Disconnect websocket
1074
1075
// Check if this user has permission to manage this computer
1076
var meshlinks = user.links[node.meshid];
1095
- if ((!meshlinks) || (!meshlinks.rights) || ((meshlinks.rights & MESHRIGHT_REMOTECONTROL) == 0)) { console.log('ERR: Access denied (2)'); return; }
1077
+ if ((!meshlinks) || (!meshlinks.rights) || ((meshlinks.rights & MESHRIGHT_REMOTECONTROL) == 0)) { console.log('ERR: Access denied (2)'); try { ws.close(); } catch (e) { } return; }
1078
1079
// Check what connectivity is available for this node
1080
var state = parent.GetConnectivityState(req.query.host);
@@ -1100,7 +1082,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1082
if (!state || state.connectivity == 0) { Debug(1, 'ERR: No routing possible (1)'); try { ws.close(); } catch (e) { } return; } else { conn = state.connectivity; }
1083
1084
// Check what server needs to handle this connection
1103
- if ((obj.parent.multiServer != null) && (peering == true)) {
1085
+ if ((obj.parent.multiServer != null) && (cookie == null)) { // If a cookie is provided, don't allow the connection to jump again to a different server
1086
var server = obj.parent.GetRoutingServerId(req.query.host, 2); // Check for Intel CIRA connection
1087
if (server != null) {
1088
if (server.serverid != obj.parent.serverId) {
@@ -1810,10 +1792,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1792
obj.app.post(url + 'uploadmeshcorefile.ashx', handleUploadMeshCoreFile);
1793
obj.app.get(url + 'userfiles/*', handleDownloadUserFiles);
1794
obj.app.ws(url + 'echo.ashx', handleEchoWebSocket);
1813
- obj.app.ws(url + 'meshrelay.ashx', function (ws, req) { try { obj.meshRelayHandler.CreateMeshRelay(obj, ws, req, getDomain(req)); } catch (e) { console.log(e); } });
1795
+ obj.app.ws(url + 'meshrelay.ashx', function (ws, req) { PerformWSSessionAuth(ws, req, function (ws1, req1, domain, user, cookie) { obj.meshRelayHandler.CreateMeshRelay(obj, ws1, req1, domain, user, cookie); }); });
1796
obj.app.get(url + 'webrelay.ashx', function (req, res) { res.send('Websocket connection expected'); });
1815
- obj.app.ws(url + 'webrelay.ashx', function (ws, req) { PerformSessionAuth(ws, req, handleRelayWebSocket); });
1816
- obj.app.ws(url + 'control.ashx', function (ws, req) { PerformSessionAuth(ws, req, function (ws1, req1, domain) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain); }); });
1797
+ obj.app.ws(url + 'webrelay.ashx', function (ws, req) { PerformWSSessionAuth(ws, req, handleRelayWebSocket); });
1798
+ obj.app.ws(url + 'control.ashx', function (ws, req) { PerformWSSessionAuth(ws, req, function (ws1, req1, domain, user, cookie) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain); }); });
1799
1800
// Server picture
1801
obj.app.get(url + 'serverpic.ashx', function (req, res) {
@@ -1847,47 +1829,50 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1829
}
1830
1831
// Authenticates a session and forwards
1850
- function PerformSessionAuth(ws, req, func) {
1832
+ function PerformWSSessionAuth(ws, req, func) {
1833
try {
1834
+ // Check IP filtering and domain
1835
var domain = checkUserIpAddress(ws, req);
1853
- if (domain != null) {
1854
- var loginok = false;
1855
- // Check if the user is logged in
1856
- if ((!req.session) || (!req.session.userid) || (req.session.domainid != domain.id)) {
1857
- // If a default user is active, setup the session here.
1858
- if (obj.args.user && obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()]) {
1859
- if (req.session && req.session.loginmode) { delete req.session.loginmode; }
1860
- req.session.userid = 'user/' + domain.id + '/' + obj.args.user.toLowerCase();
1861
- req.session.domainid = domain.id;
1862
- func(ws, req, domain);
1863
- loginok = true;
1836
+ if (domain == null) { try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth' })); ws.close(); return; } catch (e) { return; } }
1837
+
1838
+ // A web socket session can be authenticated in many ways (Default user, session, user/pass and cookie). Check authentication here.
1839
+ if ((req.query.user != null) && (req.query.pass != null)) {
1840
+ // A user/pass is provided in URL arguments
1841
+ obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid) {
1842
+ if ((err == null) && (obj.users[userid])) {
1843
+ // We are authenticated
1844
+ func(ws, req, domain, obj.users[userid]);
1845
} else {
1865
- // See the the user/pass is provided in URL arguments
1866
- if ((req.query.user != null) && (req.query.pass != null)) {
1867
- loginok = true;
1868
- obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid) {
1869
- var loginok2 = false;
1870
- if (err == null) {
1871
- var user = obj.users[userid];
1872
- if (user) {
1873
- req.session.userid = userid;
1874
- req.session.domainid = domain.id;
1875
- func(ws, req, domain);
1876
- loginok2 = true;
1877
- }
1878
- }
1879
- // If not authenticated, close the websocket connection
1880
- if (loginok2 == false) { try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth' })); ws.close(); } catch (e) { } }
1881
- });
1882
- }
1846
+ // If not authenticated, close the websocket connection
1847
+ Debug(1, 'ERR: Websocket bad user/pass auth');
1848
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth' })); ws.close(); } catch (e) { }
1849
}
1850
+ });
1851
+ return;
1852
+ } else if (req.query.auth != null) {
1853
+ // This is a encrypted cookie authentication
1854
+ var cookie = obj.parent.decodeCookie(req.query.auth, null, 60); // Cookie with 60 minute timeout
1855
+ if ((cookie != null) && (obj.users[cookie.userid])) {
1856
+ // Valid cookie, we are authenticated
1857
+ func(ws, req, domain, obj.users[cookie.userid], cookie);
1858
} else {
1885
- func(ws, req, domain);
1886
- loginok = true;
1859
+ // This is a bad cookie
1860
+ Debug(1, 'ERR: Websocket bad cookie auth: ' + req.query.auth);
1861
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth' })); ws.close(); } catch (e) { }
1862
}
1888
- // If not authenticated, close the websocket connection
1889
- if (loginok == false) { try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth' })); ws.close(); } catch (e) { } }
1863
+ return;
1864
+ } else if (obj.args.user && obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()]) {
1865
+ // A default user is active
1866
+ func(ws, req, domain, obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()]);
1867
+ return;
1868
+ } else if (req.session && (req.session.userid != null) && (req.session.domainid == obj.domain.id)) {
1869
+ // This user is logged in using the ExpressJS session
1870
+ func(ws, req, domain, req.session.userid);
1871
+ return;
1872
}
1873
+ // If not authenticated, close the websocket connection
1874
+ Debug(1, 'ERR: Websocket no auth');
1875
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth' })); ws.close(); } catch (e) { }
1876
} catch (e) { console.log(e); }
1877
}
1878