MyFavMirrors
/
MeshCentral
mirror of https://github.com/Ylianst/MeshCentral.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
MeshCentral/apprelays.js

1773 lines
99 KiB
JavaScript
Raw Normal View History

First working web-based SSH.
2021-04-30 01:31:01 -04:00
/**
* @description MeshCentral MSTSC & SSH relay
* @author Ylian Saint-Hilaire & Bryan Roe
Updated headers.
2022-01-24 02:21:24 -05:00
* @copyright Intel Corporation 2018-2022
First working web-based SSH.
2021-04-30 01:31:01 -04:00
* @license Apache-2.0
* @version v0.0.1
*/
/*jslint node: true */
/*jshint node: true */
/*jshint strict:false */
/*jshint -W097 */
/*jshint esversion: 6 */
"use strict";
Fixed local protocol events, #2813
2021-06-28 22:26:34 -04:00
/*
Protocol numbers
10 = RDP
11 = SSH-TERM
12 = VNC
More work on web relay, #4172
2022-06-24 19:53:31 -04:00
13 = SSH-FILES
14 = Web-TCP
Fixed local protocol events, #2813
2021-06-28 22:26:34 -04:00
*/
Reporting improvements.
2021-09-10 20:28:08 -04:00
// Protocol Numbers
const PROTOCOL_TERMINAL = 1;
const PROTOCOL_DESKTOP = 2;
const PROTOCOL_FILES = 5;
const PROTOCOL_AMTWSMAN = 100;
const PROTOCOL_AMTREDIR = 101;
const PROTOCOL_MESSENGER = 200;
const PROTOCOL_WEBRDP = 201;
const PROTOCOL_WEBSSH = 202;
const PROTOCOL_WEBSFTP = 203;
const PROTOCOL_WEBVNC = 204;
Added RDP viewonly and limited input.
2022-05-07 18:47:50 -04:00
// Mesh Rights
const MESHRIGHT_EDITMESH = 0x00000001; // 1
const MESHRIGHT_MANAGEUSERS = 0x00000002; // 2
const MESHRIGHT_MANAGECOMPUTERS = 0x00000004; // 4
const MESHRIGHT_REMOTECONTROL = 0x00000008; // 8
const MESHRIGHT_AGENTCONSOLE = 0x00000010; // 16
const MESHRIGHT_SERVERFILES = 0x00000020; // 32
const MESHRIGHT_WAKEDEVICE = 0x00000040; // 64
const MESHRIGHT_SETNOTES = 0x00000080; // 128
const MESHRIGHT_REMOTEVIEWONLY = 0x00000100; // 256
const MESHRIGHT_NOTERMINAL = 0x00000200; // 512
const MESHRIGHT_NOFILES = 0x00000400; // 1024
const MESHRIGHT_NOAMT = 0x00000800; // 2048
const MESHRIGHT_DESKLIMITEDINPUT = 0x00001000; // 4096
const MESHRIGHT_LIMITEVENTS = 0x00002000; // 8192
const MESHRIGHT_CHATNOTIFY = 0x00004000; // 16384
const MESHRIGHT_UNINSTALL = 0x00008000; // 32768
const MESHRIGHT_NODESKTOP = 0x00010000; // 65536
const MESHRIGHT_REMOTECOMMAND = 0x00020000; // 131072
const MESHRIGHT_RESETOFF = 0x00040000; // 262144
const MESHRIGHT_GUESTSHARING = 0x00080000; // 524288
const MESHRIGHT_DEVICEDETAILS = 0x00100000; // 1048576
const MESHRIGHT_ADMIN = 0xFFFFFFFF;
Fixed local protocol events, #2813
2021-06-28 22:26:34 -04:00
More work on web relay, #4172
2022-06-24 19:53:31 -04:00
// Construct a TCP relay object
module.exports.CreateTcpRelay = function (parent, db, req, args, domain) {
const Net = require('net');
const WebSocket = require('ws');
const obj = {};
obj.relayActive = false;
obj.closed = false;
// Events
obj.ondata = null;
obj.onconnect = null;
obj.onclose = null;
// Disconnect
obj.close = function (arg) {
if (obj.closed == true) return;
obj.closed = true;
// Event the session ending
if ((obj.startTime) && (obj.meshid != null)) {
// Collect how many raw bytes where received and sent.
// We sum both the websocket and TCP client in this case.
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
const user = parent.users[obj.cookie.userid];
const username = (user != null) ? user.name : null;
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, sessionid: obj.sessionid, msgid: 123, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SSH session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
parent.parent.DispatchEvent(['*', obj.nodeid, obj.cookie.userid, obj.meshid], obj, event);
delete obj.startTime;
delete obj.sessionid;
}
if (obj.wsClient) {
obj.wsClient.removeAllListeners('open');
obj.wsClient.removeAllListeners('message');
obj.wsClient.removeAllListeners('close');
try { obj.wsClient.close(); } catch (ex) { console.log(ex); }
delete obj.wsClient;
}
if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (ex) { console.log(ex); } } // Soft close, close the websocket
if (arg == 2) { try { ws._socket._parent.end(); } catch (ex) { console.log(ex); } } // Hard close, close the TCP socket
obj.ws.removeAllListeners();
// Event disconnection
if (obj.onclose) { obj.onclose(); }
obj.relayActive = false;
delete obj.cookie;
delete obj.nodeid;
delete obj.meshid;
delete obj.userid;
};
// Start the looppback server
function startRelayConnection() {
try {
// Setup the correct URL with domain and use TLS only if needed.
const options = { rejectUnauthorized: false };
const protocol = (args.tlsoffload) ? 'ws' : 'wss';
var domainadd = '';
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
const url = protocol + '://localhost:' + args.port + '/' + domainadd + (((obj.mtype == 3) && (obj.relaynodeid == null)) ? 'local' : 'mesh') + 'relay.ashx?p=14&auth=' + obj.xcookie; // Protocol 14 is Web-TCP
parent.parent.debug('relay', 'TCP: Connection websocket to ' + url);
obj.wsClient = new WebSocket(url, options);
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'TCP: Relay websocket open'); });
obj.wsClient.on('message', function (data) { // Make sure to handle flow control.
if (obj.relayActive == false) {
if ((data == 'c') || (data == 'cr')) {
obj.relayActive = true;
if (obj.onconnect) { obj.onconnect(); } // Event connection
}
} else {
if (typeof data == 'string') {
// Forward any ping/pong commands to the browser
var cmd = null;
try { cmd = JSON.parse(data); } catch (ex) { }
if ((cmd != null) && (cmd.ctrlChannel == '102938') && (cmd.type == 'ping')) { cmd.type = 'pong'; obj.wsClient.send(JSON.stringify(cmd)); }
return;
}
// Relay WS --> TCP, event data coming in
if (obj.ondata) { obj.ondata(data); }
}
});
obj.wsClient.on('close', function () { parent.parent.debug('relay', 'TCP: Relay websocket closed'); obj.close(); });
obj.wsClient.on('error', function (err) { parent.parent.debug('relay', 'TCP: Relay websocket error: ' + err); obj.close(); });
} catch (ex) {
console.log(ex);
}
}
// Send data thru the relay tunnel
obj.send = function (data) {
if (obj.relayActive = - false) return false;
obj.wsClient.send(data);
return true;
}
parent.parent.debug('relay', 'TCP: Request for TCP relay (' + req.clientIp + ')');
// Decode the authentication cookie
obj.cookie = parent.parent.decodeCookie(req.query.auth, parent.parent.loginCookieEncryptionKey);
if ((obj.cookie == null) || (obj.cookie.userid == null) || (parent.users[obj.cookie.userid] == null)) { obj.ws.send(JSON.stringify({ action: 'sessionerror' })); obj.close(); return; }
obj.userid = obj.cookie.userid;
// Get the meshid for this device
parent.parent.db.Get(obj.cookie.nodeid, function (err, nodes) {
if (obj.cookie == null) return; // obj has been cleaned up, just exit.
if ((err != null) || (nodes == null) || (nodes.length != 1)) { parent.parent.debug('relay', 'TCP: Invalid device'); obj.close(); }
const node = nodes[0];
obj.nodeid = node._id; // Store the NodeID
obj.meshid = node.meshid; // Store the MeshID
obj.mtype = node.mtype; // Store the device group type
// Check if we need to relay thru a different agent
const mesh = parent.meshes[obj.meshid];
if (mesh && mesh.relayid) {
obj.relaynodeid = mesh.relayid;
obj.tcpaddr = node.host;
// Check if we have rights to the relayid device, does nothing if a relay is not used
checkRelayRights(parent, domain, obj.cookie.userid, obj.relaynodeid, function (allowed) {
if (obj.cookie == null) return; // obj has been cleaned up, just exit.
if (allowed !== true) { parent.parent.debug('relay', 'TCP: Attempt to use un-authorized relay'); obj.close(); return; }
// Re-encode a cookie with a device relay
const cookieContent = { userid: obj.cookie.userid, domainid: obj.cookie.domainid, nodeid: mesh.relayid, tcpaddr: node.host, tcpport: obj.cookie.tcpport };
obj.xcookie = parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey);
});
} else {
obj.xcookie = req.query.auth;
}
});
return obj;
};
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// Construct a MSTSC Relay object, called upon connection
Added mpsHighSecurity option in config.json, #3910
2022-04-23 16:17:12 -04:00
// This implementation does not have TLS support
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// This is a bit of a hack as we are going to run the RDP connection thru a loopback connection.
// If the "node-rdpjs-2" module supported passing a socket, we would do something different.
module.exports.CreateMstscRelay = function (parent, db, ws, req, args, domain) {
const Net = require('net');
const WebSocket = require('ws');
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const obj = {};
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj.ws = ws;
obj.tcpServerPort = 0;
obj.relayActive = false;
var rdpClient = null;
parent.parent.debug('relay', 'RDP: Request for RDP relay (' + req.clientIp + ')');
// Disconnect
obj.close = function (arg) {
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (obj.ws == null) return;
Reporting improvements.
2021-09-10 20:28:08 -04:00
// Event the session ending
if ((obj.startTime) && (obj.meshid != null)) {
// Collect how many raw bytes where received and sent.
// We sum both the websocket and TCP client in this case.
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
const user = parent.users[obj.userid];
Fix for server exception, #3719
2022-02-28 12:37:25 -05:00
const username = (user != null) ? user.name : null;
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.userid, username: username, sessionid: obj.sessionid, msgid: 125, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-RDP session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBRDP, bytesin: inTraffc, bytesout: outTraffc };
parent.parent.DispatchEvent(['*', obj.nodeid, obj.userid, obj.meshid], obj, event);
Reporting improvements.
2021-09-10 20:28:08 -04:00
delete obj.startTime;
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
delete obj.sessionid;
Reporting improvements.
2021-09-10 20:28:08 -04:00
}
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (obj.wsClient) { obj.wsClient.close(); delete obj.wsClient; }
Fix for #2721
2021-06-02 15:42:38 -04:00
if (obj.tcpServer) { obj.tcpServer.close(); delete obj.tcpServer; }
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (rdpClient) { rdpClient.close(); rdpClient = null; }
Added support for Browser Ping/Pong in RDP sessions.
2022-05-05 15:38:03 -04:00
if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (ex) { console.log(ex); } } // Soft close, close the websocket
if (arg == 2) { try { ws._socket._parent.end(); } catch (ex) { console.log(ex); } } // Hard close, close the TCP socket
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
obj.ws.removeAllListeners();
obj.relayActive = false;
Reporting improvements.
2021-09-10 20:28:08 -04:00
First working web-based SSH.
2021-04-30 01:31:01 -04:00
delete obj.ws;
Reporting improvements.
2021-09-10 20:28:08 -04:00
delete obj.nodeid;
delete obj.meshid;
delete obj.userid;
First working web-based SSH.
2021-04-30 01:31:01 -04:00
};
// Start the looppback server
function startTcpServer() {
obj.tcpServer = new Net.Server();
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
obj.tcpServer.listen(0, 'localhost', function () { obj.tcpServerPort = obj.tcpServer.address().port; startRdp(obj.tcpServerPort); });
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj.tcpServer.on('connection', function (socket) {
if (obj.relaySocket != null) {
socket.close();
} else {
obj.relaySocket = socket;
obj.relaySocket.pause();
obj.relaySocket.on('data', function (chunk) { // Make sure to handle flow control.
if (obj.relayActive == true) { obj.relaySocket.pause(); obj.wsClient.send(chunk, function () { obj.relaySocket.resume(); }); }
});
obj.relaySocket.on('end', function () { obj.close(); });
obj.relaySocket.on('error', function (err) { obj.close(); });
// Setup the correct URL with domain and use TLS only if needed.
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const options = { rejectUnauthorized: false };
const protocol = (args.tlsoffload) ? 'ws' : 'wss';
First working web-based SSH.
2021-04-30 01:31:01 -04:00
var domainadd = '';
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
Added support for Browser Ping/Pong in RDP sessions.
2022-05-05 15:38:03 -04:00
const url = protocol + '://localhost:' + args.port + '/' + domainadd + (((obj.mtype == 3) && (obj.relaynodeid == null)) ? 'local' : 'mesh') + 'relay.ashx?p=10&auth=' + obj.infos.ip; // Protocol 10 is Web-RDP
First working web-based SSH.
2021-04-30 01:31:01 -04:00
parent.parent.debug('relay', 'RDP: Connection websocket to ' + url);
obj.wsClient = new WebSocket(url, options);
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'RDP: Relay websocket open'); });
obj.wsClient.on('message', function (data) { // Make sure to handle flow control.
Added support for Browser Ping/Pong in RDP sessions.
2022-05-05 15:38:03 -04:00
if (obj.relayActive == false) {
if ((data == 'c') || (data == 'cr')) {
obj.relayActive = true;
obj.relaySocket.resume();
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
} else {
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
if (typeof data == 'string') {
// Forward any ping/pong commands to the browser
var cmd = null;
try { cmd = JSON.parse(data); } catch (ex) { }
if ((cmd != null) && (cmd.ctrlChannel == '102938')) {
if (cmd.type == 'ping') { send(['ping']); }
else if (cmd.type == 'pong') { send(['pong']); }
}
return;
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj.wsClient._socket.pause();
Added support for Browser Ping/Pong in RDP sessions.
2022-05-05 15:38:03 -04:00
try {
obj.relaySocket.write(data, function () {
First pass at adding RDP clipboard support, #3810.
2022-05-15 02:00:57 -04:00
if (obj.wsClient && obj.wsClient._socket) { try { obj.wsClient._socket.resume(); } catch (ex) { console.log(ex); } }
Added support for Browser Ping/Pong in RDP sessions.
2022-05-05 15:38:03 -04:00
});
} catch (ex) { console.log(ex); obj.close(); }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}
});
obj.wsClient.on('close', function () { parent.parent.debug('relay', 'RDP: Relay websocket closed'); obj.close(); });
obj.wsClient.on('error', function (err) { parent.parent.debug('relay', 'RDP: Relay websocket error: ' + err); obj.close(); });
obj.tcpServer.close();
obj.tcpServer = null;
}
});
}
// Start the RDP client
function startRdp(port) {
parent.parent.debug('relay', 'RDP: Starting RDP client on loopback port ' + port);
try {
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
const args = {
Added Web based RDP support with NLA, #3867 and #3914
2022-04-29 14:13:58 -04:00
logLevel: 'NONE', // 'ERROR',
First working web-based SSH.
2021-04-30 01:31:01 -04:00
domain: obj.infos.domain,
userName: obj.infos.username,
password: obj.infos.password,
enablePerf: true,
autoLogin: true,
screen: obj.infos.screen,
Completed RDP settings.
2022-05-04 16:11:52 -04:00
locale: obj.infos.locale,
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
};
Added RDP alternate shell / working dir, #3943
2022-05-08 14:46:07 -04:00
if (obj.infos.options) {
if (obj.infos.options.flags != null) { args.perfFlags = obj.infos.options.flags; delete obj.infos.options.flags; }
if ((obj.infos.options.workingDir != null) && (obj.infos.options.workingDir != '')) { args.workingDir = obj.infos.options.workingDir; }
if ((obj.infos.options.alternateShell != null) && (obj.infos.options.alternateShell != '')) { args.alternateShell = obj.infos.options.alternateShell; }
}
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
rdpClient = require('./rdp').createClient(args).on('connect', function () {
First working web-based SSH.
2021-04-30 01:31:01 -04:00
send(['rdp-connect']);
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
if ((typeof obj.infos.options == 'object') && (obj.infos.options.savepass == true)) { saveRdpCredentials(); } // Save the credentials if needed
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
Reporting improvements.
2021-09-10 20:28:08 -04:00
obj.startTime = Date.now();
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
// Event session start
try {
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
const user = parent.users[obj.userid];
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
const username = (user != null) ? user.name : null;
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.userid, username: username, sessionid: obj.sessionid, msgid: 150, msgArgs: [obj.sessionid], msg: "Started Web-RDP session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBRDP };
parent.parent.DispatchEvent(['*', obj.nodeid, obj.userid, obj.meshid], obj, event);
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
} catch (ex) { console.log(ex); }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}).on('bitmap', function (bitmap) {
try { ws.send(bitmap.data); } catch (ex) { } // Send the bitmap data as binary
delete bitmap.data;
send(['rdp-bitmap', bitmap]); // Send the bitmap metadata seperately, without bitmap data.
First pass at adding RDP clipboard support, #3810.
2022-05-15 02:00:57 -04:00
}).on('clipboard', function (content) {
Added Web-RDP mouse cursor support.
2022-06-24 01:10:07 -04:00
send(['rdp-clipboard', content]); // The clipboard data has changed
}).on('pointer', function (cursorId, cursorStr) {
if (cursorStr == null) { cursorStr = 'default'; }
if (obj.lastCursorStrSent != cursorStr) {
obj.lastCursorStrSent = cursorStr;
//console.log('pointer', cursorStr);
send(['rdp-pointer', cursorStr]); // The mouse pointer has changed
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}).on('close', function () {
Added Web-RDP mouse cursor support.
2022-06-24 01:10:07 -04:00
send(['rdp-close']); // This RDP session has closed
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}).on('error', function (err) {
Improved RDP error handling, #4022
2022-05-21 00:52:03 -04:00
if (typeof err == 'string') { send(['rdp-error', err]); }
if ((typeof err == 'object') && (err.err) && (err.code)) { send(['rdp-error', err.err, err.code]); }
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
}).connect('localhost', obj.tcpServerPort);
First working web-based SSH.
2021-04-30 01:31:01 -04:00
} catch (ex) {
console.log('startRdpException', ex);
obj.close();
}
}
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Save RDP credentials into database
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
function saveRdpCredentials() {
Added new allowSavingDeviceCredentials option, #3751
2022-03-15 20:00:43 -04:00
if (domain.allowsavingdevicecredentials == false) return;
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
parent.parent.db.Get(obj.nodeid, function (err, nodes) {
if ((err != null) || (nodes == null) || (nodes.length != 1)) return;
const node = nodes[0];
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
if (node.rdp == null) { node.rdp = {}; }
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Check if credentials are already set
if ((typeof node.rdp[obj.userid] == 'object') && (node.rdp[obj.userid].d == obj.infos.domain) && (node.rdp[obj.userid].u == obj.infos.username) && (node.rdp[obj.userid].p == obj.infos.password)) return;
// Clear up any existing credentials or credentials for users that don't exist anymore
for (var i in node.rdp) { if (!i.startsWith('user/') || (parent.users[i] == null)) { delete node.rdp[i]; } }
// Clear legacy credentials
delete node.rdp.d;
delete node.rdp.u;
delete node.rdp.p;
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
// Save the credentials
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.rdp[obj.userid] = { d: obj.infos.domain, u: obj.infos.username, p: obj.infos.password };
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
parent.parent.db.Set(node);
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Event the node change
const event = { etype: 'node', action: 'changenode', nodeid: obj.nodeid, domain: domain.id, userid: obj.userid, node: parent.CloneSafeNode(node), msg: "Changed RDP credentials" };
if (parent.parent.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the node. Another event will come.
parent.parent.DispatchEvent(parent.CreateMeshDispatchTargets(node.meshid, [obj.nodeid]), obj, event);
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
});
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// When data is received from the web socket
// RDP default port is 3389
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
ws.on('message', function (data) {
First working web-based SSH.
2021-04-30 01:31:01 -04:00
try {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
var msg = null;
try { msg = JSON.parse(data); } catch (ex) { }
if ((msg == null) || (typeof msg != 'object')) return;
First working web-based SSH.
2021-04-30 01:31:01 -04:00
switch (msg[0]) {
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
case 'infos': {
obj.infos = msg[1];
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
if (obj.infos.ip.startsWith('node/')) {
// Use the user session
obj.nodeid = obj.infos.ip;
obj.userid = req.session.userid;
} else {
// Decode the authentication cookie
obj.cookie = parent.parent.decodeCookie(obj.infos.ip, parent.parent.loginCookieEncryptionKey);
if ((obj.cookie == null) || (typeof obj.cookie.nodeid != 'string') || (typeof obj.cookie.userid != 'string')) { obj.close(); return; }
obj.nodeid = obj.cookie.nodeid;
obj.userid = obj.cookie.userid;
}
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
Added RDP viewonly and limited input.
2022-05-07 18:47:50 -04:00
// Get node and rights
parent.GetNodeWithRights(domain, obj.userid, obj.nodeid, function (node, rights, visible) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
if (obj.ws == null) return; // obj has been cleaned up, just exit.
Added RDP viewonly and limited input.
2022-05-07 18:47:50 -04:00
if ((node == null) || (visible == false) || ((rights & MESHRIGHT_REMOTECONTROL) == 0)) { obj.close(); return; }
if ((rights != MESHRIGHT_ADMIN) && ((rights & MESHRIGHT_REMOTEVIEWONLY) != 0)) { obj.viewonly = true; }
if ((rights != MESHRIGHT_ADMIN) && ((rights & MESHRIGHT_DESKLIMITEDINPUT) != 0)) { obj.limitedinput = true; }
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
obj.mtype = node.mtype; // Store the device group type
obj.meshid = node.meshid; // Store the MeshID
// Check if we need to relay thru a different agent
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const mesh = parent.meshes[obj.meshid];
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (mesh && mesh.relayid) {
obj.relaynodeid = mesh.relayid;
obj.tcpaddr = node.host;
More RDP to desktop tab improvements.
2022-05-03 19:24:43 -04:00
// Get the TCP port to use
var tcpport = 3389;
if ((obj.cookie != null) && (obj.cookie.tcpport != null)) { tcpport = obj.cookie.tcpport; } else { if (node.rdpport) { tcpport = node.rdpport } }
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
// Re-encode a cookie with a device relay
More RDP to desktop tab improvements.
2022-05-03 19:24:43 -04:00
const cookieContent = { userid: obj.userid, domainid: domain.id, nodeid: mesh.relayid, tcpaddr: node.host, tcpport: tcpport };
First integration of RDP into the desktop tab.
2022-05-03 00:06:32 -04:00
obj.infos.ip = parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey);
} else if (obj.infos.ip.startsWith('node/')) {
// Encode a cookie with a device relay
const cookieContent = { userid: obj.userid, domainid: domain.id, nodeid: obj.nodeid, tcpport: node.rdpport ? node.rdpport : 3389 };
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
obj.infos.ip = parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey);
}
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check if we have rights to the relayid device, does nothing if a relay is not used
checkRelayRights(parent, domain, obj.userid, obj.relaynodeid, function (allowed) {
if (obj.ws == null) return; // obj has been cleaned up, just exit.
if (allowed !== true) { parent.parent.debug('relay', 'RDP: Attempt to use un-authorized relay'); obj.close(); return; }
// Check if we need to load server stored credentials
if ((typeof obj.infos.options == 'object') && (obj.infos.options.useServerCreds == true)) {
// Check if RDP credentials exist
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
if ((domain.allowsavingdevicecredentials !== false) && (typeof node.rdp == 'object') && (typeof node.rdp[obj.userid] == 'object') && (typeof node.rdp[obj.userid].d == 'string') && (typeof node.rdp[obj.userid].u == 'string') && (typeof node.rdp[obj.userid].p == 'string')) {
obj.infos.domain = node.rdp[obj.userid].d;
obj.infos.username = node.rdp[obj.userid].u;
obj.infos.password = node.rdp[obj.userid].p;
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
startTcpServer();
} else {
// No server credentials.
obj.infos.domain = '';
obj.infos.username = '';
obj.infos.password = '';
startTcpServer();
}
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
} else {
startTcpServer();
}
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
});
Reporting improvements.
2021-09-10 20:28:08 -04:00
});
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
break;
}
Added RDP viewonly and limited input.
2022-05-07 18:47:50 -04:00
case 'mouse': { if (rdpClient && (obj.viewonly != true)) { rdpClient.sendPointerEvent(msg[1], msg[2], msg[3], msg[4]); } break; }
case 'wheel': { if (rdpClient && (obj.viewonly != true)) { rdpClient.sendWheelEvent(msg[1], msg[2], msg[3], msg[4]); } break; }
First pass at adding RDP clipboard support, #3810.
2022-05-15 02:00:57 -04:00
case 'clipboard': { rdpClient.setClipboardData(msg[1]); break; }
Added RDP viewonly and limited input.
2022-05-07 18:47:50 -04:00
case 'scancode': {
if (obj.limitedinput == true) { // Limit keyboard input
var ok = false, k = msg[1];
if ((k >= 2) && (k <= 11)) { ok = true; } // Number keys 1 to 0
if ((k >= 16) && (k <= 25)) { ok = true; } // First keyboard row
if ((k >= 30) && (k <= 38)) { ok = true; } // Second keyboard row
if ((k >= 44) && (k <= 50)) { ok = true; } // Third keyboard row
if ((k == 14) || (k == 28)) { ok = true; } // Enter and backspace
if (ok == false) return;
}
if (rdpClient && (obj.viewonly != true)) { rdpClient.sendKeyEventScancode(msg[1], msg[2]); } break;
}
case 'unicode': { if (rdpClient && (obj.viewonly != true)) { rdpClient.sendKeyEventUnicode(msg[1], msg[2]); } break; }
Added typing feature to integrated RDP.
2022-05-05 20:42:40 -04:00
case 'utype': {
if (!rdpClient) return;
obj.utype = msg[1];
if (obj.utypetimer == null) {
obj.utypetimer = setInterval(function () {
if ((obj.utype == null) || (obj.utype.length == 0)) { clearInterval(obj.utypetimer); obj.utypetimer = null; return; }
var c = obj.utype.charCodeAt(0);
obj.utype = obj.utype.substring(1);
if (c == 13) return;
if (c == 10) { rdpClient.sendKeyEventScancode(28, true); rdpClient.sendKeyEventScancode(28, false); }
else { rdpClient.sendKeyEventUnicode(c, true); rdpClient.sendKeyEventUnicode(c, false); }
}, 5);
}
break;
}
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
case 'ping': { try { obj.wsClient.send('{"ctrlChannel":102938,"type":"ping"}'); } catch (ex) { } break; }
case 'pong': { try { obj.wsClient.send('{"ctrlChannel":102938,"type":"pong"}'); } catch (ex) { } break; }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
case 'disconnect': { obj.close(); break; }
}
} catch (ex) {
console.log('RdpMessageException', msg, ex);
obj.close();
}
});
// If error, do nothing
ws.on('error', function (err) { parent.parent.debug('relay', 'RDP: Browser websocket error: ' + err); obj.close(); });
// If the web socket is closed
ws.on('close', function (req) { parent.parent.debug('relay', 'RDP: Browser websocket closed'); obj.close(); });
// Send an object with flow control
function send(obj) {
try { rdpClient.bufferLayer.socket.pause(); } catch (ex) { }
try { ws.send(JSON.stringify(obj), function () { try { rdpClient.bufferLayer.socket.resume(); } catch (ex) { } }); } catch (ex) { }
}
// We are all set, start receiving data
ws._socket.resume();
return obj;
};
// Construct a SSH Relay object, called upon connection
module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
const Net = require('net');
const WebSocket = require('ws');
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// SerialTunnel object is used to embed SSH within another connection.
function SerialTunnel(options) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const obj = new require('stream').Duplex(options);
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj.forwardwrite = null;
obj.updateBuffer = function (chunk) { this.push(chunk); };
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
obj._write = function (chunk, encoding, callback) { if (obj.forwardwrite != null) { obj.forwardwrite(chunk); } if (callback) callback(); }; // Pass data written to forward
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj._read = function (size) { }; // Push nothing, anything to read should be pushed from updateBuffer()
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
obj.destroy = function () { delete obj.forwardwrite; }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
return obj;
}
const obj = {};
obj.ws = ws;
obj.relayActive = false;
// Disconnect
obj.close = function (arg) {
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (obj.ws == null) return;
Reporting improvements.
2021-09-10 20:28:08 -04:00
// Event the session ending
if ((obj.startTime) && (obj.meshid != null)) {
// Collect how many raw bytes where received and sent.
// We sum both the websocket and TCP client in this case.
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
const user = parent.users[obj.cookie.userid];
const username = (user != null) ? user.name : null;
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, sessionid: obj.sessionid, msgid: 123, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SSH session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
Reporting improvements.
2021-09-10 20:28:08 -04:00
parent.parent.DispatchEvent(['*', obj.nodeid, obj.cookie.userid, obj.meshid], obj, event);
delete obj.startTime;
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
delete obj.sessionid;
Reporting improvements.
2021-09-10 20:28:08 -04:00
}
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (obj.sshShell) {
obj.sshShell.destroy();
obj.sshShell.removeAllListeners('data');
obj.sshShell.removeAllListeners('close');
try { obj.sshShell.end(); } catch (ex) { console.log(ex); }
delete obj.sshShell;
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (obj.sshClient) {
obj.sshClient.destroy();
obj.sshClient.removeAllListeners('ready');
First working web-based SSH.
2021-04-30 01:31:01 -04:00
try { obj.sshClient.end(); } catch (ex) { console.log(ex); }
delete obj.sshClient;
}
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
if (obj.wsClient) {
obj.wsClient.removeAllListeners('open');
obj.wsClient.removeAllListeners('message');
obj.wsClient.removeAllListeners('close');
try { obj.wsClient.close(); } catch (ex) { console.log(ex); }
delete obj.wsClient;
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}
Intel AMT fixes for #2628
2021-05-12 12:10:54 -04:00
if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (ex) { console.log(ex); } } // Soft close, close the websocket
if (arg == 2) { try { ws._socket._parent.end(); } catch (ex) { console.log(ex); } } // Hard close, close the TCP socket
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
obj.ws.removeAllListeners();
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj.relayActive = false;
delete obj.termSize;
delete obj.cookie;
Reporting improvements.
2021-09-10 20:28:08 -04:00
delete obj.nodeid;
delete obj.meshid;
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
delete obj.userid;
First working web-based SSH.
2021-04-30 01:31:01 -04:00
delete obj.ws;
};
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Save SSH credentials into database
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
function saveSshCredentials(keep) {
if (((keep != 1) && (keep != 2)) || (domain.allowsavingdevicecredentials == false)) return;
parent.parent.db.Get(obj.nodeid, function (err, nodes) {
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
if ((err != null) || (nodes == null) || (nodes.length != 1)) return;
const node = nodes[0];
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
if (node.ssh == null) { node.ssh = {}; }
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
// Check if credentials are the same
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
//if ((typeof node.ssh[obj.userid] == 'object') && (node.ssh[obj.userid].u == obj.username) && (node.ssh[obj.userid].p == obj.password)) return; // TODO
// Clear up any existing credentials or credentials for users that don't exist anymore
for (var i in node.ssh) { if (!i.startsWith('user/') || (parent.users[i] == null)) { delete node.ssh[i]; } }
// Clear legacy credentials
delete node.ssh.u;
delete node.ssh.p;
delete node.ssh.k;
delete node.ssh.kp;
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
// Save the credentials
if (obj.password != null) {
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.ssh[obj.userid] = { u: obj.username, p: obj.password };
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
} else if (obj.privateKey != null) {
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.ssh[obj.userid] = { u: obj.username, k: obj.privateKey };
if (keep == 2) { node.ssh[obj.userid].kp = obj.privateKeyPass; }
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
} else return;
parent.parent.db.Set(node);
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Event the node change
const event = { etype: 'node', action: 'changenode', nodeid: obj.nodeid, domain: domain.id, userid: obj.userid, node: parent.CloneSafeNode(node), msg: "Changed SSH credentials" };
if (parent.parent.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the node. Another event will come.
parent.parent.DispatchEvent(parent.CreateMeshDispatchTargets(node.meshid, [obj.nodeid]), obj, event);
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
});
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// Start the looppback server
function startRelayConnection() {
try {
// Setup the correct URL with domain and use TLS only if needed.
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const options = { rejectUnauthorized: false };
const protocol = (args.tlsoffload) ? 'ws' : 'wss';
First working web-based SSH.
2021-04-30 01:31:01 -04:00
var domainadd = '';
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
const url = protocol + '://localhost:' + args.port + '/' + domainadd + (((obj.mtype == 3) && (obj.relaynodeid == null)) ? 'local' : 'mesh') + 'relay.ashx?p=11&auth=' + obj.xcookie; // Protocol 11 is Web-SSH
First working web-based SSH.
2021-04-30 01:31:01 -04:00
parent.parent.debug('relay', 'SSH: Connection websocket to ' + url);
obj.wsClient = new WebSocket(url, options);
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'SSH: Relay websocket open'); });
obj.wsClient.on('message', function (data) { // Make sure to handle flow control.
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
if (obj.relayActive == false) {
if ((data == 'c') || (data == 'cr')) {
obj.relayActive = true;
// Create a serial tunnel && SSH module
obj.ser = new SerialTunnel();
const Client = require('ssh2').Client;
obj.sshClient = new Client();
obj.sshClient.on('ready', function () { // Authentication was successful.
// If requested, save the credentials
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
saveSshCredentials(obj.keep);
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
obj.startTime = Date.now();
// Event start of session
try {
const user = parent.users[obj.cookie.userid];
const username = (user != null) ? user.name : null;
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 148, msgArgs: [obj.sessionid], msg: "Started Web-SSH session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBSSH };
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
} catch (ex) { console.log(ex); }
obj.sshClient.shell(function (err, stream) { // Start a remote shell
if (err) { obj.close(); return; }
obj.sshShell = stream;
obj.sshShell.setWindow(obj.termSize.rows, obj.termSize.cols, obj.termSize.height, obj.termSize.width);
obj.sshShell.on('close', function () { obj.close(); });
obj.sshShell.on('data', function (data) { obj.ws.send('~' + data.toString()); });
});
obj.ws.send(JSON.stringify({ action: 'connected' }));
});
obj.sshClient.on('error', function (err) {
if (err.level == 'client-authentication') { try { obj.ws.send(JSON.stringify({ action: 'autherror' })); } catch (ex) { } }
if (err.level == 'client-timeout') { try { obj.ws.send(JSON.stringify({ action: 'sessiontimeout' })); } catch (ex) { } }
obj.close();
First working web-based SSH.
2021-04-30 01:31:01 -04:00
});
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// Setup the serial tunnel, SSH ---> Relay WS
obj.ser.forwardwrite = function (data) { if ((data.length > 0) && (obj.wsClient != null)) { try { obj.wsClient.send(data); } catch (ex) { } } };
// Connect the SSH module to the serial tunnel
const connectionOptions = { sock: obj.ser }
if (typeof obj.username == 'string') { connectionOptions.username = obj.username; }
if (typeof obj.password == 'string') { connectionOptions.password = obj.password; }
if (typeof obj.privateKey == 'string') { connectionOptions.privateKey = obj.privateKey; }
if (typeof obj.privateKeyPass == 'string') { connectionOptions.passphrase = obj.privateKeyPass; }
try {
obj.sshClient.connect(connectionOptions);
} catch (ex) {
// Exception, this is generally because we did not provide proper credentials. Ask again.
obj.relayActive = false;
delete obj.sshClient;
delete obj.ser.forwardwrite;
obj.close();
return;
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// We are all set, start receiving data
ws._socket.resume();
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
} else {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (typeof data == 'string') {
// Forward any ping/pong commands to the browser
var cmd = null;
try { cmd = JSON.parse(data); } catch (ex) { }
if ((cmd != null) && (cmd.ctrlChannel == '102938') && ((cmd.type == 'ping') || (cmd.type == 'pong'))) { obj.ws.send(data); }
return;
}
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// Relay WS --> SSH
if ((data.length > 0) && (obj.ser != null)) { try { obj.ser.updateBuffer(data); } catch (ex) { console.log(ex); } }
}
});
obj.wsClient.on('close', function () { parent.parent.debug('relay', 'SSH: Relay websocket closed'); obj.close(); });
obj.wsClient.on('error', function (err) { parent.parent.debug('relay', 'SSH: Relay websocket error: ' + err); obj.close(); });
} catch (ex) {
console.log(ex);
}
}
// When data is received from the web socket
// SSH default port is 22
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
ws.on('message', function (data) {
First working web-based SSH.
2021-04-30 01:31:01 -04:00
try {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (typeof data != 'string') return;
if (data[0] == '{') {
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// Control data
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
var msg = null;
try { msg = JSON.parse(data); } catch (ex) { }
if ((msg == null) || (typeof msg != 'object')) return;
if ((msg.ctrlChannel == '102938') && ((msg.type == 'ping') || (msg.type == 'pong'))) { try { obj.wsClient.send(data); } catch (ex) { } return; }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
if (typeof msg.action != 'string') return;
switch (msg.action) {
case 'connect': {
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
if (msg.useexisting) {
// Check if we have SSH credentials for this device
parent.parent.db.Get(obj.cookie.nodeid, function (err, nodes) {
if ((err != null) || (nodes == null) || (nodes.length != 1)) return;
const node = nodes[0];
Web-SSH fixes and improvements.
2022-05-19 17:41:32 -04:00
if ((domain.allowsavingdevicecredentials === false) || (node.ssh == null) || (typeof node.ssh != 'object') || (node.ssh[obj.userid] == null) || (typeof node.ssh[obj.userid].u != 'string') || ((typeof node.ssh[obj.userid].p != 'string') && (typeof node.ssh[obj.userid].k != 'string'))) {
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
// Send a request for SSH authentication
try { ws.send(JSON.stringify({ action: 'sshauth' })) } catch (ex) { }
Web-SSH fixes and improvements.
2022-05-19 17:41:32 -04:00
} else if ((domain.allowsavingdevicecredentials !== false) && (node.ssh != null) && (typeof node.ssh[obj.userid].k == 'string') && (node.ssh[obj.userid].kp == null)) {
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
// Send a request for SSH authentication with option for only the private key password
Web-SSH fixes and improvements.
2022-05-19 17:41:32 -04:00
obj.username = node.ssh[obj.userid].u;
obj.privateKey = node.ssh[obj.userid].k;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
try { ws.send(JSON.stringify({ action: 'sshauth', askkeypass: true })) } catch (ex) { }
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
} else {
// Use our existing credentials
obj.termSize = msg;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
delete obj.keep;
Web-SSH fixes and improvements.
2022-05-19 17:41:32 -04:00
obj.username = node.ssh[obj.userid].u;
if (typeof node.ssh[obj.userid].p == 'string') {
obj.password = node.ssh[obj.userid].p;
} else if (typeof node.ssh[obj.userid].k == 'string') {
obj.privateKey = node.ssh[obj.userid].k;
obj.privateKeyPass = node.ssh[obj.userid].kp;
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
}
startRelayConnection();
}
});
} else {
// Verify inputs
if ((typeof msg.username != 'string') || ((typeof msg.password != 'string') && (typeof msg.key != 'string'))) break;
if ((typeof msg.rows != 'number') || (typeof msg.cols != 'number') || (typeof msg.height != 'number') || (typeof msg.width != 'number')) break;
obj.termSize = msg;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
if (msg.keep === true) { msg.keep = 1; } // If true, change to 1. For user/pass, 1 to store user/pass in db. For user/key/pass, 1 to store user/key in db, 2 to store everything in db.
obj.keep = msg.keep; // If set, keep store credentials on the server if the SSH tunnel connected succesfully.
Added SSH key auth and remember to agent Win-SSH link, #3108
2021-09-07 15:42:51 -04:00
obj.username = msg.username;
obj.password = msg.password;
obj.privateKey = msg.key;
obj.privateKeyPass = msg.keypass;
startRelayConnection();
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
break;
}
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
case 'connectKeyPass': {
// Verify inputs
if (typeof msg.keypass != 'string') break;
// Check if we have SSH credentials for this device
obj.privateKeyPass = msg.keypass;
obj.termSize = msg;
parent.parent.db.Get(obj.cookie.nodeid, function (err, nodes) {
if ((err != null) || (nodes == null) || (nodes.length != 1)) return;
const node = nodes[0];
if (node.ssh != null) {
obj.username = node.ssh.u;
obj.privateKey = node.ssh.k;
startRelayConnection();
}
});
break;
}
First working web-based SSH.
2021-04-30 01:31:01 -04:00
case 'resize': {
Added SSH input validation.
2021-05-08 22:03:35 -04:00
// Verify inputs
if ((typeof msg.rows != 'number') || (typeof msg.cols != 'number') || (typeof msg.height != 'number') || (typeof msg.width != 'number')) break;
First working web-based SSH.
2021-04-30 01:31:01 -04:00
obj.termSize = msg;
if (obj.sshShell != null) { obj.sshShell.setWindow(obj.termSize.rows, obj.termSize.cols, obj.termSize.height, obj.termSize.width); }
break;
}
}
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
} else if (data[0] == '~') {
First working web-based SSH.
2021-04-30 01:31:01 -04:00
// Terminal data
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (obj.sshShell != null) { obj.sshShell.write(data.substring(1)); }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
}
Improved Web-SSH, Web-RDP and session logging.
2021-05-05 03:18:41 -04:00
} catch (ex) { obj.close(); }
First working web-based SSH.
2021-04-30 01:31:01 -04:00
});
// If error, do nothing
ws.on('error', function (err) { parent.parent.debug('relay', 'SSH: Browser websocket error: ' + err); obj.close(); });
// If the web socket is closed
ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
Reporting improvements.
2021-09-10 20:28:08 -04:00
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
parent.parent.debug('relay', 'SSH: Request for SSH relay (' + req.clientIp + ')');
// Decode the authentication cookie
obj.cookie = parent.parent.decodeCookie(req.query.auth, parent.parent.loginCookieEncryptionKey);
Web-SSH fixes and improvements.
2022-05-19 17:41:32 -04:00
if ((obj.cookie == null) || (obj.cookie.userid == null) || (parent.users[obj.cookie.userid] == null)) { obj.ws.send(JSON.stringify({ action: 'sessionerror' })); obj.close(); return; }
obj.userid = obj.cookie.userid;
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
Reporting improvements.
2021-09-10 20:28:08 -04:00
// Get the meshid for this device
parent.parent.db.Get(obj.cookie.nodeid, function (err, nodes) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
if (obj.cookie == null) return; // obj has been cleaned up, just exit.
Reporting improvements.
2021-09-10 20:28:08 -04:00
if ((err != null) || (nodes == null) || (nodes.length != 1)) { parent.parent.debug('relay', 'SSH: Invalid device'); obj.close(); }
const node = nodes[0];
obj.nodeid = node._id; // Store the NodeID
obj.meshid = node.meshid; // Store the MeshID
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
obj.mtype = node.mtype; // Store the device group type
// Check if we need to relay thru a different agent
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const mesh = parent.meshes[obj.meshid];
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (mesh && mesh.relayid) {
obj.relaynodeid = mesh.relayid;
obj.tcpaddr = node.host;
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check if we have rights to the relayid device, does nothing if a relay is not used
checkRelayRights(parent, domain, obj.cookie.userid, obj.relaynodeid, function (allowed) {
if (obj.cookie == null) return; // obj has been cleaned up, just exit.
if (allowed !== true) { parent.parent.debug('relay', 'SSH: Attempt to use un-authorized relay'); obj.close(); return; }
// Re-encode a cookie with a device relay
const cookieContent = { userid: obj.cookie.userid, domainid: obj.cookie.domainid, nodeid: mesh.relayid, tcpaddr: node.host, tcpport: obj.cookie.tcpport };
obj.xcookie = parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey);
});
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
} else {
obj.xcookie = req.query.auth;
}
Reporting improvements.
2021-09-10 20:28:08 -04:00
});
First working web-based SSH.
2021-04-30 01:31:01 -04:00
return obj;
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
};
// Construct a SSH Terminal Relay object, called upon connection
module.exports.CreateSshTerminalRelay = function (parent, db, ws, req, domain, user, cookie, args) {
const Net = require('net');
const WebSocket = require('ws');
// SerialTunnel object is used to embed SSH within another connection.
function SerialTunnel(options) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const obj = new require('stream').Duplex(options);
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
obj.forwardwrite = null;
obj.updateBuffer = function (chunk) { this.push(chunk); };
obj._write = function (chunk, encoding, callback) { if (obj.forwardwrite != null) { obj.forwardwrite(chunk); } if (callback) callback(); }; // Pass data written to forward
obj._read = function (size) { }; // Push nothing, anything to read should be pushed from updateBuffer()
obj.destroy = function () { delete obj.forwardwrite; }
return obj;
}
const obj = {};
obj.ws = ws;
obj.relayActive = false;
High res Assistant images.
2021-05-25 13:13:18 -04:00
parent.parent.debug('relay', 'SSH: Request for SSH terminal relay (' + req.clientIp + ')');
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Disconnect
obj.close = function (arg) {
if (obj.ws == null) return;
Reporting improvements.
2021-09-10 20:28:08 -04:00
// Event the session ending
if (obj.startTime) {
// Collect how many raw bytes where received and sent.
// We sum both the websocket and TCP client in this case.
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 123, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SSH session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
Reporting improvements.
2021-09-10 20:28:08 -04:00
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
delete obj.startTime;
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
delete obj.sessionid;
Reporting improvements.
2021-09-10 20:28:08 -04:00
}
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
if (obj.sshShell) {
obj.sshShell.destroy();
obj.sshShell.removeAllListeners('data');
obj.sshShell.removeAllListeners('close');
try { obj.sshShell.end(); } catch (ex) { console.log(ex); }
delete obj.sshShell;
}
if (obj.sshClient) {
obj.sshClient.destroy();
obj.sshClient.removeAllListeners('ready');
try { obj.sshClient.end(); } catch (ex) { console.log(ex); }
delete obj.sshClient;
}
if (obj.wsClient) {
obj.wsClient.removeAllListeners('open');
obj.wsClient.removeAllListeners('message');
obj.wsClient.removeAllListeners('close');
try { obj.wsClient.close(); } catch (ex) { console.log(ex); }
delete obj.wsClient;
}
Intel AMT fixes for #2628
2021-05-12 12:10:54 -04:00
if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (ex) { console.log(ex); } } // Soft close, close the websocket
if (arg == 2) { try { ws._socket._parent.end(); } catch (ex) { console.log(ex); } } // Hard close, close the TCP socket
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
obj.ws.removeAllListeners();
obj.relayActive = false;
delete obj.termSize;
Reporting improvements.
2021-09-10 20:28:08 -04:00
delete obj.nodeid;
delete obj.meshid;
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
delete obj.ws;
};
SSH remember credentials.
2021-05-21 16:43:32 -04:00
// Save SSH credentials into device
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
function saveSshCredentials(keep) {
if (((keep != 1) && (keep != 2)) || (domain.allowsavingdevicecredentials == false)) return;
SSH remember credentials.
2021-05-21 16:43:32 -04:00
parent.parent.db.Get(obj.nodeid, function (err, nodes) {
if ((err != null) || (nodes == null) || (nodes.length != 1)) return;
const node = nodes[0];
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
if (node.ssh == null) { node.ssh = {}; }
SSH remember credentials.
2021-05-21 16:43:32 -04:00
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
// Check if credentials are the same
Added SSH Key support.
2021-08-13 01:52:42 -04:00
//if ((typeof node.ssh == 'object') && (node.ssh.u == obj.username) && (node.ssh.p == obj.password)) return; // TODO
MeshCentral can now remember RDP credentials.
2021-06-29 20:13:18 -04:00
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Clear up any existing credentials or credentials for users that don't exist anymore
for (var i in node.ssh) { if (!i.startsWith('user/') || (parent.users[i] == null)) { delete node.ssh[i]; } }
// Clear legacy credentials
delete node.ssh.u;
delete node.ssh.p;
delete node.ssh.k;
delete node.ssh.kp;
SSH remember credentials.
2021-05-21 16:43:32 -04:00
// Save the credentials
Added SSH Key support.
2021-08-13 01:52:42 -04:00
if (obj.password != null) {
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.ssh[user._id] = { u: obj.username, p: obj.password };
Added SSH Key support.
2021-08-13 01:52:42 -04:00
} else if (obj.privateKey != null) {
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.ssh[user._id] = { u: obj.username, k: obj.privateKey };
if (keep == 2) { node.ssh[user._id].kp = obj.privateKeyPass; }
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
} else return;
SSH remember credentials.
2021-05-21 16:43:32 -04:00
parent.parent.db.Set(node);
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Event the node change
const event = { etype: 'node', action: 'changenode', nodeid: obj.nodeid, domain: domain.id, userid: user._id, username: user.name, node: parent.CloneSafeNode(node), msg: "Changed SSH credentials" };
if (parent.parent.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the node. Another event will come.
parent.parent.DispatchEvent(parent.CreateMeshDispatchTargets(node.meshid, [obj.nodeid]), obj, event);
SSH remember credentials.
2021-05-21 16:43:32 -04:00
});
}
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Start the looppback server
function startRelayConnection(authCookie) {
try {
// Setup the correct URL with domain and use TLS only if needed.
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const options = { rejectUnauthorized: false };
const protocol = (args.tlsoffload) ? 'ws' : 'wss';
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
var domainadd = '';
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
const url = protocol + '://localhost:' + args.port + '/' + domainadd + (((obj.mtype == 3) && (obj.relaynodeid == null)) ? 'local' : 'mesh') + 'relay.ashx?p=11&auth=' + authCookie // Protocol 11 is Web-SSH
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
parent.parent.debug('relay', 'SSH: Connection websocket to ' + url);
obj.wsClient = new WebSocket(url, options);
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'SSH: Relay websocket open'); });
obj.wsClient.on('message', function (data) { // Make sure to handle flow control.
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
if (obj.relayActive == false) {
if ((data == 'c') || (data == 'cr')) {
obj.relayActive = true;
// Create a serial tunnel && SSH module
obj.ser = new SerialTunnel();
const Client = require('ssh2').Client;
obj.sshClient = new Client();
obj.sshClient.on('ready', function () { // Authentication was successful.
// If requested, save the credentials
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
saveSshCredentials(obj.keep);
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
obj.startTime = Date.now();
try {
// Event start of session
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 148, msgArgs: [obj.sessionid], msg: "Started Web-SSH session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBSSH };
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
} catch (ex) {
console.log(ex);
}
SSH remember credentials.
2021-05-21 16:43:32 -04:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
obj.sshClient.shell(function (err, stream) { // Start a remote shell
if (err) { obj.close(); return; }
obj.sshShell = stream;
obj.sshShell.setWindow(obj.termSize.rows, obj.termSize.cols, obj.termSize.height, obj.termSize.width);
obj.sshShell.on('close', function () { obj.close(); });
obj.sshShell.on('data', function (data) { obj.ws.send('~' + data.toString()); });
});
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
obj.connected = true;
obj.ws.send('c');
});
obj.sshClient.on('error', function (err) {
if (err.level == 'client-authentication') { try { obj.ws.send(JSON.stringify({ action: 'autherror' })); } catch (ex) { } }
if (err.level == 'client-timeout') { try { obj.ws.send(JSON.stringify({ action: 'sessiontimeout' })); } catch (ex) { } }
obj.close();
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
});
Improved SSH error messages.
2021-05-24 22:22:29 -04:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// Setup the serial tunnel, SSH ---> Relay WS
obj.ser.forwardwrite = function (data) { if ((data.length > 0) && (obj.wsClient != null)) { try { obj.wsClient.send(data); } catch (ex) { } } };
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// Connect the SSH module to the serial tunnel
const connectionOptions = { sock: obj.ser }
if (typeof obj.username == 'string') { connectionOptions.username = obj.username; }
if (typeof obj.password == 'string') { connectionOptions.password = obj.password; }
if (typeof obj.privateKey == 'string') { connectionOptions.privateKey = obj.privateKey; }
if (typeof obj.privateKeyPass == 'string') { connectionOptions.passphrase = obj.privateKeyPass; }
try {
obj.sshClient.connect(connectionOptions);
} catch (ex) {
// Exception, this is generally because we did not provide proper credentials. Ask again.
obj.relayActive = false;
delete obj.sshClient;
delete obj.ser.forwardwrite;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
try { ws.send(JSON.stringify({ action: 'sshauth', askkeypass: ((obj.username != null) && (obj.privateKey != null)) })) } catch (ex) { }
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
}
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// We are all set, start receiving data
ws._socket.resume();
}
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
} else {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (typeof data == 'string') {
// Forward any ping/pong commands to the browser
var cmd = null;
try { cmd = JSON.parse(data); } catch (ex) { }
if ((cmd != null) && (cmd.ctrlChannel == '102938') && ((cmd.type == 'ping') || (cmd.type == 'pong'))) { try { obj.ws.send(data); } catch (ex) { console.log(ex); } }
return;
}
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Relay WS --> SSH
if ((data.length > 0) && (obj.ser != null)) { try { obj.ser.updateBuffer(data); } catch (ex) { console.log(ex); } }
}
});
Improved SSH error messages.
2021-05-24 22:22:29 -04:00
obj.wsClient.on('close', function () {
if (obj.connected !== true) { try { obj.ws.send(JSON.stringify({ action: 'connectionerror' })); } catch (ex) { } }
parent.parent.debug('relay', 'SSH: Relay websocket closed'); obj.close();
});
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
obj.wsClient.on('error', function (err) { parent.parent.debug('relay', 'SSH: Relay websocket error: ' + err); obj.close(); });
} catch (ex) {
console.log(ex);
}
}
// When data is received from the web socket
// SSH default port is 22
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
ws.on('message', function (data) {
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
try {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (typeof data != 'string') return;
if (data[0] == '{') {
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Control data
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
var msg = null;
try { msg = JSON.parse(data); } catch (ex) { }
if ((msg == null) || (typeof msg != 'object')) return;
if ((msg.ctrlChannel == '102938') && ((msg.type == 'ping') || (msg.type == 'pong'))) { try { obj.wsClient.send(data); } catch (ex) { } return; }
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
switch (msg.action) {
case 'sshauth': {
Added SSH input validation.
2021-05-08 22:03:35 -04:00
// Verify inputs
Added SSH Key support.
2021-08-13 01:52:42 -04:00
if ((typeof msg.username != 'string') || ((typeof msg.password != 'string') && (typeof msg.key != 'string'))) break;
Added SSH input validation.
2021-05-08 22:03:35 -04:00
if ((typeof msg.rows != 'number') || (typeof msg.cols != 'number') || (typeof msg.height != 'number') || (typeof msg.width != 'number')) break;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
if (msg.keep === true) { msg.keep = 1; } // If true, change to 1. For user/pass, 1 to store user/pass in db. For user/key/pass, 1 to store user/key in db, 2 to store everything in db.
obj.keep = msg.keep; // If set, keep store credentials on the server if the SSH tunnel connected succesfully.
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
obj.termSize = msg;
obj.username = msg.username;
obj.password = msg.password;
Added SSH Key support.
2021-08-13 01:52:42 -04:00
obj.privateKey = msg.key;
obj.privateKeyPass = msg.keypass;
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Create a mesh relay authentication cookie
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const cookieContent = { userid: user._id, domainid: user.domain, nodeid: obj.nodeid, tcpport: obj.tcpport };
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (obj.relaynodeid) {
cookieContent.nodeid = obj.relaynodeid;
cookieContent.tcpaddr = obj.tcpaddr;
} else {
if (obj.mtype == 3) { cookieContent.lc = 1; } // This is a local device
}
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
startRelayConnection(parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey));
break;
}
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
case 'sshkeyauth': {
// Verify inputs
if (typeof msg.keypass != 'string') break;
if ((typeof msg.rows != 'number') || (typeof msg.cols != 'number') || (typeof msg.height != 'number') || (typeof msg.width != 'number')) break;
delete obj.keep;
obj.termSize = msg;
obj.privateKeyPass = msg.keypass;
// Create a mesh relay authentication cookie
const cookieContent = { userid: user._id, domainid: user.domain, nodeid: obj.nodeid, tcpport: obj.tcpport };
if (obj.relaynodeid) {
cookieContent.nodeid = obj.relaynodeid;
cookieContent.tcpaddr = obj.tcpaddr;
} else {
if (obj.mtype == 3) { cookieContent.lc = 1; } // This is a local device
}
startRelayConnection(parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey));
break;
}
SSH remember credentials.
2021-05-21 16:43:32 -04:00
case 'sshautoauth': {
// Verify inputs
if ((typeof msg.rows != 'number') || (typeof msg.cols != 'number') || (typeof msg.height != 'number') || (typeof msg.width != 'number')) break;
obj.termSize = msg;
Added SSH Key support.
2021-08-13 01:52:42 -04:00
if ((obj.username == null) || ((obj.password == null) && (obj.privateKey == null))) return;
SSH remember credentials.
2021-05-21 16:43:32 -04:00
// Create a mesh relay authentication cookie
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const cookieContent = { userid: user._id, domainid: user.domain, nodeid: obj.nodeid, tcpport: obj.tcpport };
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (obj.relaynodeid) {
cookieContent.nodeid = obj.relaynodeid;
cookieContent.tcpaddr = obj.tcpaddr;
} else {
if (obj.mtype == 3) { cookieContent.lc = 1; } // This is a local device
}
SSH remember credentials.
2021-05-21 16:43:32 -04:00
startRelayConnection(parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey));
break;
}
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
case 'resize': {
Added SSH input validation.
2021-05-08 22:03:35 -04:00
// Verify inputs
if ((typeof msg.rows != 'number') || (typeof msg.cols != 'number') || (typeof msg.height != 'number') || (typeof msg.width != 'number')) break;
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
obj.termSize = msg;
if (obj.sshShell != null) { obj.sshShell.setWindow(obj.termSize.rows, obj.termSize.cols, obj.termSize.height, obj.termSize.width); }
break;
}
}
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
} else if (data[0] == '~') {
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Terminal data
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (obj.sshShell != null) { obj.sshShell.write(data.substring(1)); }
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
}
} catch (ex) { obj.close(); }
});
// If error, do nothing
ws.on('error', function (err) { parent.parent.debug('relay', 'SSH: Browser websocket error: ' + err); obj.close(); });
// If the web socket is closed
ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
Fix for #2682
2021-05-25 13:35:37 -04:00
// Check that we have a user and nodeid
if ((user == null) || (req.query.nodeid == null)) { obj.close(); return; } // Invalid nodeid
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
parent.GetNodeWithRights(domain, user, req.query.nodeid, function (node, rights, visible) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
if (obj.ws == null) return; // obj has been cleaned up, just exit.
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Check permissions
if ((rights & 8) == 0) { obj.close(); return; } // No MESHRIGHT_REMOTECONTROL rights
if ((rights != 0xFFFFFFFF) && (rights & 0x00000200)) { obj.close(); return; } // MESHRIGHT_NOTERMINAL is set
obj.mtype = node.mtype; // Store the device group type
obj.nodeid = node._id; // Store the NodeID
Reporting improvements.
2021-09-10 20:28:08 -04:00
obj.meshid = node.meshid; // Store the MeshID
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
// Check the SSH port
obj.tcpport = 22;
if (typeof node.sshport == 'number') { obj.tcpport = node.sshport; }
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
// Check if we need to relay thru a different agent
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const mesh = parent.meshes[obj.meshid];
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (mesh && mesh.relayid) { obj.relaynodeid = mesh.relayid; obj.tcpaddr = node.host; }
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check if we have rights to the relayid device, does nothing if a relay is not used
checkRelayRights(parent, domain, user, obj.relaynodeid, function (allowed) {
if (obj.ws == null) return; // obj has been cleaned up, just exit.
if (allowed !== true) { parent.parent.debug('relay', 'SSH: Attempt to use un-authorized relay'); obj.close(); return; }
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// We are all set, start receiving data
ws._socket.resume();
SSH remember credentials.
2021-05-21 16:43:32 -04:00
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check if we have SSH credentials for this device
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
if ((domain.allowsavingdevicecredentials === false) || (node.ssh == null) || (typeof node.ssh != 'object') || (node.ssh[user._id] == null) || (typeof node.ssh[user._id].u != 'string') || ((typeof node.ssh[user._id].p != 'string') && (typeof node.ssh[user._id].k != 'string'))) {
SSH remember credentials.
2021-05-21 16:43:32 -04:00
// Send a request for SSH authentication
try { ws.send(JSON.stringify({ action: 'sshauth' })) } catch (ex) { }
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
} else if ((typeof node.ssh[user._id].k == 'string') && (typeof node.ssh[user._id].kp != 'string')) {
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
// Send a request for SSH authentication with option for only the private key password
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
obj.username = node.ssh[user._id].u;
obj.privateKey = node.ssh[user._id].k;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
try { ws.send(JSON.stringify({ action: 'sshauth', askkeypass: true })) } catch (ex) { }
SSH remember credentials.
2021-05-21 16:43:32 -04:00
} else {
// Use our existing credentials
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
obj.username = node.ssh[user._id].u;
if (typeof node.ssh[user._id].p == 'string') {
obj.password = node.ssh[user._id].p;
} else if (typeof node.ssh[user._id].k == 'string') {
obj.privateKey = node.ssh[user._id].k;
obj.privateKeyPass = node.ssh[user._id].kp;
Added SSH Key support.
2021-08-13 01:52:42 -04:00
}
SSH remember credentials.
2021-05-21 16:43:32 -04:00
try { ws.send(JSON.stringify({ action: 'sshautoauth' })) } catch (ex) { }
}
});
Added SSH support in terminal tab for local devices.
2021-05-08 21:09:49 -04:00
});
return obj;
};
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Construct a SSH Files Relay object, called upon connection
module.exports.CreateSshFilesRelay = function (parent, db, ws, req, domain, user, cookie, args) {
const Net = require('net');
const WebSocket = require('ws');
// SerialTunnel object is used to embed SSH within another connection.
function SerialTunnel(options) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const obj = new require('stream').Duplex(options);
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
obj.forwardwrite = null;
obj.updateBuffer = function (chunk) { this.push(chunk); };
obj._write = function (chunk, encoding, callback) { if (obj.forwardwrite != null) { obj.forwardwrite(chunk); } if (callback) callback(); }; // Pass data written to forward
obj._read = function (size) { }; // Push nothing, anything to read should be pushed from updateBuffer()
obj.destroy = function () { delete obj.forwardwrite; }
return obj;
}
const obj = {};
obj.ws = ws;
obj.path = require('path');
obj.relayActive = false;
obj.firstMessage = true;
parent.parent.debug('relay', 'SSH: Request for SSH files relay (' + req.clientIp + ')');
// Disconnect
obj.close = function (arg) {
if (obj.ws == null) return;
Reporting improvements.
2021-09-10 20:28:08 -04:00
// Event the session ending
if (obj.startTime) {
// Collect how many raw bytes where received and sent.
// We sum both the websocket and TCP client in this case.
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, sessionid: obj.sessionid, msgid: 124, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SFTP session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSFTP, bytesin: inTraffc, bytesout: outTraffc };
Reporting improvements.
2021-09-10 20:28:08 -04:00
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
delete obj.startTime;
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
delete obj.sessionid;
Reporting improvements.
2021-09-10 20:28:08 -04:00
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
if (obj.sshClient) {
obj.sshClient.destroy();
obj.sshClient.removeAllListeners('ready');
try { obj.sshClient.end(); } catch (ex) { console.log(ex); }
delete obj.sshClient;
}
if (obj.wsClient) {
obj.wsClient.removeAllListeners('open');
obj.wsClient.removeAllListeners('message');
obj.wsClient.removeAllListeners('close');
try { obj.wsClient.close(); } catch (ex) { console.log(ex); }
delete obj.wsClient;
}
if ((arg == 1) || (arg == null)) { try { ws.close(); } catch (ex) { console.log(ex); } } // Soft close, close the websocket
if (arg == 2) { try { ws._socket._parent.end(); } catch (ex) { console.log(ex); } } // Hard close, close the TCP socket
obj.ws.removeAllListeners();
obj.relayActive = false;
delete obj.sftp;
Reporting improvements.
2021-09-10 20:28:08 -04:00
delete obj.nodeid;
delete obj.meshid;
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
delete obj.ws;
};
// Save SSH credentials into device
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
function saveSshCredentials(keep) {
if (((keep != 1) && (keep != 2)) || (domain.allowsavingdevicecredentials == false)) return;
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
parent.parent.db.Get(obj.nodeid, function (err, nodes) {
if ((err != null) || (nodes == null) || (nodes.length != 1)) return;
const node = nodes[0];
Fixed server exception when remembering SFTP credentials, #4080
2022-06-06 11:06:32 -04:00
if (node.ssh == null) { node.ssh = {}; }
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
Added SSH Key support.
2021-08-13 01:52:42 -04:00
// Check if credentials are the same
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
//if ((typeof node.ssh[obj.userid] == 'object') && (node.ssh[obj.userid].u == obj.username) && (node.ssh[obj.userid].p == obj.password)) return; // TODO
// Clear up any existing credentials or credentials for users that don't exist anymore
for (var i in node.ssh) { if (!i.startsWith('user/') || (parent.users[i] == null)) { delete node.ssh[i]; } }
// Clear legacy credentials
delete node.ssh.u;
delete node.ssh.p;
delete node.ssh.k;
delete node.ssh.kp;
Added SSH Key support.
2021-08-13 01:52:42 -04:00
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Save the credentials
Added SSH Key support.
2021-08-13 01:52:42 -04:00
if (obj.password != null) {
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.ssh[user._id] = { u: obj.username, p: obj.password };
Added SSH Key support.
2021-08-13 01:52:42 -04:00
} else if (obj.privateKey != null) {
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
node.ssh[user._id] = { u: obj.username, k: obj.privateKey };
if (keep == 2) { node.ssh[user._id].kp = obj.privateKeyPass; }
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
} else return;
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
parent.parent.db.Set(node);
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
// Event the node change
const event = { etype: 'node', action: 'changenode', nodeid: obj.nodeid, domain: domain.id, userid: user._id, username: user.name, node: parent.CloneSafeNode(node), msg: "Changed SSH credentials" };
if (parent.parent.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the node. Another event will come.
parent.parent.DispatchEvent(parent.CreateMeshDispatchTargets(node.meshid, [obj.nodeid]), obj, event);
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
});
}
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Start the looppback server
function startRelayConnection(authCookie) {
try {
// Setup the correct URL with domain and use TLS only if needed.
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const options = { rejectUnauthorized: false };
const protocol = (args.tlsoffload) ? 'ws' : 'wss';
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
var domainadd = '';
if ((domain.dns == null) && (domain.id != '')) { domainadd = domain.id + '/' }
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
const url = protocol + '://localhost:' + args.port + '/' + domainadd + (((obj.mtype == 3) && (obj.relaynodeid == null)) ? 'local' : 'mesh') + 'relay.ashx?p=13&auth=' + authCookie // Protocol 13 is Web-SSH-Files
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
parent.parent.debug('relay', 'SSH: Connection websocket to ' + url);
obj.wsClient = new WebSocket(url, options);
obj.wsClient.on('open', function () { parent.parent.debug('relay', 'SSH: Relay websocket open'); });
obj.wsClient.on('message', function (data) { // Make sure to handle flow control.
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
if (obj.relayActive == false) {
if ((data == 'c') || (data == 'cr')) {
obj.relayActive = true;
// Create a serial tunnel && SSH module
obj.ser = new SerialTunnel();
const Client = require('ssh2').Client;
obj.sshClient = new Client();
obj.sshClient.on('ready', function () { // Authentication was successful.
// If requested, save the credentials
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
saveSshCredentials(obj.keep);
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
obj.startTime = Date.now();
Improved SSH/FTP/RDP event logs, #3679
2022-02-22 13:56:45 -05:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// Event start of session
try {
const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 149, msgArgs: [obj.sessionid], msg: "Started Web-SFTP session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBSFTP };
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
} catch (ex) { console.log(ex); }
obj.sshClient.sftp(function (err, sftp) {
if (err) { obj.close(); return; }
obj.connected = true;
obj.sftp = sftp;
obj.ws.send('c');
});
});
obj.sshClient.on('error', function (err) {
if (err.level == 'client-authentication') { try { obj.ws.send(JSON.stringify({ action: 'autherror' })); } catch (ex) { } }
if (err.level == 'client-timeout') { try { obj.ws.send(JSON.stringify({ action: 'sessiontimeout' })); } catch (ex) { } }
obj.close();
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
});
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// Setup the serial tunnel, SSH ---> Relay WS
obj.ser.forwardwrite = function (data) { if ((data.length > 0) && (obj.wsClient != null)) { try { obj.wsClient.send(data); } catch (ex) { } } };
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
// Connect the SSH module to the serial tunnel
const connectionOptions = { sock: obj.ser }
if (typeof obj.username == 'string') { connectionOptions.username = obj.username; }
if (typeof obj.password == 'string') { connectionOptions.password = obj.password; }
if (typeof obj.privateKey == 'string') { connectionOptions.privateKey = obj.privateKey; }
if (typeof obj.privateKeyPass == 'string') { connectionOptions.passphrase = obj.privateKeyPass; }
try {
obj.sshClient.connect(connectionOptions);
} catch (ex) {
// Exception, this is generally because we did not provide proper credentials. Ask again.
obj.relayActive = false;
delete obj.sshClient;
delete obj.ser.forwardwrite;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
try { ws.send(JSON.stringify({ action: 'sshauth', askkeypass: ((obj.username != null) && (obj.privateKey != null)) })) } catch (ex) { }
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
}
// We are all set, start receiving data
ws._socket.resume();
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
} else {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (typeof data == 'string') {
// Forward any ping/pong commands to the browser
var cmd = null;
try { cmd = JSON.parse(data); } catch (ex) { }
if ((cmd != null) && (cmd.ctrlChannel == '102938') && ((cmd.type == 'ping') || (cmd.type == 'pong'))) { obj.ws.send(data); }
return;
}
Added full agent ping/pong support on RDP sessions.
2022-05-05 16:17:34 -04:00
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Relay WS --> SSH
if ((data.length > 0) && (obj.ser != null)) { try { obj.ser.updateBuffer(data); } catch (ex) { console.log(ex); } }
}
});
Improved SSH error messages.
2021-05-24 22:22:29 -04:00
obj.wsClient.on('close', function () {
if (obj.connected !== true) { try { obj.ws.send(JSON.stringify({ action: 'connectionerror' })); } catch (ex) { } }
parent.parent.debug('relay', 'SSH: Files relay websocket closed'); obj.close();
});
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
obj.wsClient.on('error', function (err) { parent.parent.debug('relay', 'SSH: Files relay websocket error: ' + err); obj.close(); });
} catch (ex) {
console.log(ex);
}
}
// When data is received from the web socket
// SSH default port is 22
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
ws.on('message', function (data) {
Improved SSH error messages.
2021-05-24 22:22:29 -04:00
//if ((obj.firstMessage === true) && (msg != 5)) { obj.close(); return; } else { delete obj.firstMessage; }
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
try {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (typeof data != 'string') {
if (data[0] == 123) {
data = data.toString();
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
} else if ((obj.sftp != null) && (obj.uploadHandle != null)) {
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
const off = (data[0] == 0) ? 1 : 0;
obj.sftp.write(obj.uploadHandle, data, off, data.length - off, obj.uploadPosition, function (err) {
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
if (err != null) {
obj.sftp.close(obj.uploadHandle, function () { });
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'uploaddone', reqid: obj.uploadReqid }))) } catch (ex) { }
delete obj.uploadHandle;
delete obj.uploadFullpath;
delete obj.uploadSize;
delete obj.uploadReqid;
delete obj.uploadPosition;
} else {
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'uploadack', reqid: obj.uploadReqid }))) } catch (ex) { }
}
});
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
obj.uploadPosition += (data.length - off);
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
return;
}
}
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
if (data[0] == '{') {
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Control data
Added full agent ping/pong support on SSH/SFTP sessions.
2022-05-05 19:16:58 -04:00
var msg = null;
try { msg = JSON.parse(data); } catch (ex) { }
if ((msg == null) || (typeof msg != 'object')) return;
if ((msg.ctrlChannel == '102938') && ((msg.type == 'ping') || (msg.type == 'pong'))) { try { obj.wsClient.send(data); } catch (ex) { } return; }
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
if (typeof msg.action != 'string') return;
switch (msg.action) {
case 'ls': {
if (obj.sftp == null) return;
var requestedPath = msg.path;
if (requestedPath.startsWith('/') == false) { requestedPath = '/' + requestedPath; }
obj.sftp.readdir(requestedPath, function(err, list) {
if (err) { console.log(err); obj.close(); }
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const r = { path: requestedPath, reqid: msg.reqid, dir: [] };
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
for (var i in list) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const file = list[i];
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
if (file.longname[0] == 'd') { r.dir.push({ t: 2, n: file.filename, d: new Date(file.attrs.mtime * 1000).toISOString() }); }
else { r.dir.push({ t: 3, n: file.filename, d: new Date(file.attrs.mtime * 1000).toISOString(), s: file.attrs.size }); }
}
try { obj.ws.send(Buffer.from(JSON.stringify(r))) } catch (ex) { }
});
break;
}
case 'mkdir': {
if (obj.sftp == null) return;
var requestedPath = msg.path;
if (requestedPath.startsWith('/') == false) { requestedPath = '/' + requestedPath; }
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
obj.sftp.mkdir(requestedPath, function (err) { });
// Event the file delete
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const targets = ['*', 'server-users'];
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
parent.parent.DispatchEvent(targets, obj, { etype: 'node', action: 'agentlog', nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 44, msgArgs: [requestedPath], msg: 'Create folder: \"' + requestedPath + '\"', domain: domain.id });
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
break;
}
case 'rm': {
if (obj.sftp == null) return;
var requestedPath = msg.path;
if (requestedPath.startsWith('/') == false) { requestedPath = '/' + requestedPath; }
for (var i in msg.delfiles) {
const ul = obj.path.join(requestedPath, msg.delfiles[i]).split('\\').join('/');
obj.sftp.unlink(ul, function (err) { });
if (msg.rec === true) { obj.sftp.rmdir(ul + '/', function (err) { }); }
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
// Event the file delete
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const targets = ['*', 'server-users'];
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
parent.parent.DispatchEvent(targets, obj, { etype: 'node', action: 'agentlog', nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 45, msgArgs: [ul], msg: 'Delete: \"' + ul + '\"', domain: domain.id });
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
}
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
break;
}
case 'rename': {
if (obj.sftp == null) return;
var requestedPath = msg.path;
if (requestedPath.startsWith('/') == false) { requestedPath = '/' + requestedPath; }
const oldpath = obj.path.join(requestedPath, msg.oldname).split('\\').join('/');
const newpath = obj.path.join(requestedPath, msg.newname).split('\\').join('/');
obj.sftp.rename(oldpath, newpath, function (err) { });
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
// Event the file rename
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const targets = ['*', 'server-users'];
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
parent.parent.DispatchEvent(targets, obj, { etype: 'node', action: 'agentlog', nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 48, msgArgs: [oldpath, msg.newname], msg: 'Rename: \"' + oldpath + '\" to \"' + msg.newname + '\"', domain: domain.id });
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
break;
}
case 'upload': {
if (obj.sftp == null) return;
var requestedPath = msg.path;
if (requestedPath.startsWith('/') == false) { requestedPath = '/' + requestedPath; }
obj.uploadFullpath = obj.path.join(requestedPath, msg.name).split('\\').join('/');
obj.uploadSize = msg.size;
obj.uploadReqid = msg.reqid;
obj.uploadPosition = 0;
obj.sftp.open(obj.uploadFullpath, 'w', 0o666, function (err, handle) {
if (err != null) {
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'uploaderror', reqid: obj.uploadReqid }))) } catch (ex) { }
} else {
obj.uploadHandle = handle;
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'uploadstart', reqid: obj.uploadReqid }))) } catch (ex) { }
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
// Event the file upload
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const targets = ['*', 'server-users'];
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
parent.parent.DispatchEvent(targets, obj, { etype: 'node', action: 'agentlog', nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 105, msgArgs: [obj.uploadFullpath, obj.uploadSize], msg: 'Upload: ' + obj.uploadFullpath + ', Size: ' + obj.uploadSize, domain: domain.id });
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
}
});
break;
}
case 'uploaddone': {
if (obj.sftp == null) return;
if (obj.uploadHandle != null) {
obj.sftp.close(obj.uploadHandle, function () { });
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'uploaddone', reqid: obj.uploadReqid }))) } catch (ex) { }
delete obj.uploadHandle;
delete obj.uploadFullpath;
delete obj.uploadSize;
delete obj.uploadReqid;
delete obj.uploadPosition;
}
break;
}
case 'uploadcancel': {
if (obj.sftp == null) return;
if (obj.uploadHandle != null) {
obj.sftp.close(obj.uploadHandle, function () { });
obj.sftp.unlink(obj.uploadFullpath, function (err) { });
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'uploadcancel', reqid: obj.uploadReqid }))) } catch (ex) { }
delete obj.uploadHandle;
delete obj.uploadFullpath;
delete obj.uploadSize;
delete obj.uploadReqid;
delete obj.uploadPosition;
}
break;
}
Completed SSH file transfer.
2021-05-24 21:13:53 -04:00
case 'download': {
if (obj.sftp == null) return;
switch (msg.sub) {
case 'start': {
var requestedPath = msg.path;
if (requestedPath.startsWith('/') == false) { requestedPath = '/' + requestedPath; }
obj.downloadFullpath = requestedPath;
obj.downloadId = msg.id;
obj.downloadPosition = 0;
obj.downloadBuffer = Buffer.alloc(16384);
obj.sftp.open(obj.downloadFullpath, 'r', function (err, handle) {
if (err != null) {
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'download', sub: 'cancel', id: obj.downloadId }))) } catch (ex) { }
} else {
obj.downloadHandle = handle;
try { obj.ws.send(JSON.stringify({ action: 'download', sub: 'start', id: obj.downloadId })) } catch (ex) { }
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
// Event the file download
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const targets = ['*', 'server-users'];
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
parent.parent.DispatchEvent(targets, obj, { etype: 'node', action: 'agentlog', nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 49, msgArgs: [obj.downloadFullpath], msg: 'Download: ' + obj.downloadFullpath, domain: domain.id });
Completed SSH file transfer.
2021-05-24 21:13:53 -04:00
}
});
break;
}
case 'startack': {
if ((obj.downloadHandle == null) || (obj.downloadId != msg.id)) break;
obj.downloadPendingBlockCount = (typeof msg.ack == 'number') ? msg.ack : 8;
uploadNextBlock();
break;
}
case 'ack': {
if ((obj.downloadHandle == null) || (obj.downloadId != msg.id)) break;
if (obj.downloadPendingBlockCount == 0) { obj.downloadPendingBlockCount = 1; uploadNextBlock(); }
break;
}
case 'stop': {
if ((obj.downloadHandle == null) || (obj.downloadId != msg.id)) break;
if (obj.downloadHandle != null) { obj.sftp.close(obj.downloadHandle, function () { }); }
delete obj.downloadId;
delete obj.downloadBuffer;
delete obj.downloadHandle;
delete obj.downloadFullpath;
delete obj.downloadPosition;
delete obj.downloadPendingBlockCount;
break;
}
}
break;
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
case 'sshauth': {
if (obj.sshClient != null) return;
// Verify inputs
Added SSH Key support.
2021-08-13 01:52:42 -04:00
if ((typeof msg.username != 'string') || ((typeof msg.password != 'string') && (typeof msg.key != 'string'))) break;
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
if (msg.keep === true) { msg.keep = 1; } // If true, change to 1. For user/pass, 1 to store user/pass in db. For user/key/pass, 1 to store user/key in db, 2 to store everything in db.
obj.keep = msg.keep; // If set, keep store credentials on the server if the SSH tunnel connected succesfully.
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
obj.username = msg.username;
obj.password = msg.password;
Added SSH Key support.
2021-08-13 01:52:42 -04:00
obj.privateKey = msg.key;
obj.privateKeyPass = msg.keypass;
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
// Create a mesh relay authentication cookie
const cookieContent = { userid: user._id, domainid: user.domain, nodeid: obj.nodeid, tcpport: obj.tcpport };
if (obj.relaynodeid) {
cookieContent.nodeid = obj.relaynodeid;
cookieContent.tcpaddr = obj.tcpaddr;
} else {
if (obj.mtype == 3) { cookieContent.lc = 1; } // This is a local device
}
startRelayConnection(parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey));
break;
}
case 'sshkeyauth': {
if (obj.sshClient != null) return;
// Verify inputs
if (typeof msg.keypass != 'string') break;
delete obj.keep;
obj.privateKeyPass = msg.keypass;
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Create a mesh relay authentication cookie
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const cookieContent = { userid: user._id, domainid: user.domain, nodeid: obj.nodeid, tcpport: obj.tcpport };
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (obj.relaynodeid) {
cookieContent.nodeid = obj.relaynodeid;
cookieContent.tcpaddr = obj.tcpaddr;
} else {
if (obj.mtype == 3) { cookieContent.lc = 1; } // This is a local device
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
startRelayConnection(parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey));
break;
}
}
}
Added SSH file operation log.
2021-05-24 22:47:29 -04:00
} catch (ex) { obj.close(); }
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
});
Completed SSH file transfer.
2021-05-24 21:13:53 -04:00
function uploadNextBlock() {
if (obj.downloadBuffer == null) return;
obj.sftp.read(obj.downloadHandle, obj.downloadBuffer, 4, obj.downloadBuffer.length - 4, obj.downloadPosition, function (err, len, buf) {
obj.downloadPendingBlockCount--;
if (obj.downloadBuffer == null) return;
if (err != null) {
try { obj.ws.send(Buffer.from(JSON.stringify({ action: 'download', sub: 'cancel', id: obj.downloadId }))) } catch (ex) { }
} else {
obj.downloadPosition += len;
if (len < (obj.downloadBuffer.length - 4)) {
obj.downloadBuffer.writeInt32BE(0x01000001, 0)
if (len > 0) { try { obj.ws.send(obj.downloadBuffer.slice(0, len + 4)); } catch (ex) { console.log(ex); } }
} else {
obj.downloadBuffer.writeInt32BE(0x01000000, 0);
try { obj.ws.send(obj.downloadBuffer.slice(0, len + 4)); } catch (ex) { console.log(ex); }
if (obj.downloadPendingBlockCount > 0) { uploadNextBlock(); }
return;
}
}
if (obj.downloadHandle != null) { obj.sftp.close(obj.downloadHandle, function () { }); }
delete obj.downloadId;
delete obj.downloadBuffer;
delete obj.downloadHandle;
delete obj.downloadFullpath;
delete obj.downloadPosition;
delete obj.downloadPendingBlockCount;
});
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// If error, do nothing
ws.on('error', function (err) { parent.parent.debug('relay', 'SSH: Browser websocket error: ' + err); obj.close(); });
// If the web socket is closed
ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
Fix for #2682
2021-05-25 13:35:37 -04:00
// Check that we have a user and nodeid
if ((user == null) || (req.query.nodeid == null)) { obj.close(); return; } // Invalid nodeid
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
parent.GetNodeWithRights(domain, user, req.query.nodeid, function (node, rights, visible) {
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
if (obj.ws == null) return; // obj has been cleaned up, just exit.
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Check permissions
if ((rights & 8) == 0) { obj.close(); return; } // No MESHRIGHT_REMOTECONTROL rights
if ((rights != 0xFFFFFFFF) && (rights & 0x00000200)) { obj.close(); return; } // MESHRIGHT_NOTERMINAL is set
obj.mtype = node.mtype; // Store the device group type
obj.nodeid = node._id; // Store the NodeID
Reporting improvements.
2021-09-10 20:28:08 -04:00
obj.meshid = node.meshid; // Store the MeshID
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Check the SSH port
obj.tcpport = 22;
if (typeof node.sshport == 'number') { obj.tcpport = node.sshport; }
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
// Check if we need to relay thru a different agent
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const mesh = parent.meshes[obj.meshid];
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (mesh && mesh.relayid) { obj.relaynodeid = mesh.relayid; obj.tcpaddr = node.host; }
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check if we have rights to the relayid device, does nothing if a relay is not used
checkRelayRights(parent, domain, user, obj.relaynodeid, function (allowed) {
if (obj.ws == null) return; // obj has been cleaned up, just exit.
if (allowed !== true) { parent.parent.debug('relay', 'SSH: Attempt to use un-authorized relay'); obj.close(); return; }
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// We are all set, start receiving data
ws._socket.resume();
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check if we have SSH credentials for this device
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
if ((domain.allowsavingdevicecredentials === false) || (node.ssh == null) || (typeof node.ssh != 'object') || (node.ssh[user._id] == null) || (typeof node.ssh[user._id].u != 'string') || ((typeof node.ssh[user._id].p != 'string') && (typeof node.ssh[user._id].k != 'string'))) {
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Send a request for SSH authentication
try { ws.send(JSON.stringify({ action: 'sshauth' })) } catch (ex) { }
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
} else if ((typeof node.ssh[user._id].k == 'string') && (typeof node.ssh[user._id].kp != 'string')) {
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
// Send a request for SSH authentication with option for only the private key password
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
obj.username = node.ssh[user._id].u;
obj.privateKey = node.ssh[user._id].k;
Added option to save SSH username and key without saving key password.
2022-05-10 20:44:34 -04:00
try { ws.send(JSON.stringify({ action: 'sshauth', askkeypass: true })) } catch (ex) { }
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
} else {
// Use our existing credentials
SSH/RDP credentials are now stored per user account, #3995
2022-05-17 19:09:35 -04:00
obj.username = node.ssh[user._id].u;
if (typeof node.ssh[user._id].p == 'string') {
obj.password = node.ssh[user._id].p;
} else if (typeof node.ssh[user._id].k == 'string') {
obj.privateKey = node.ssh[user._id].k;
obj.privateKeyPass = node.ssh[user._id].kp;
Added SSH Key support.
2021-08-13 01:52:42 -04:00
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
// Create a mesh relay authentication cookie
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
const cookieContent = { userid: user._id, domainid: user.domain, nodeid: obj.nodeid, tcpport: obj.tcpport };
Completed initial version of agent-less deivce group reached thru a agent, #3867
2022-04-13 21:58:37 -04:00
if (obj.relaynodeid) {
cookieContent.nodeid = obj.relaynodeid;
cookieContent.tcpaddr = obj.tcpaddr;
} else {
if (obj.mtype == 3) { cookieContent.lc = 1; } // This is a local device
}
Partial SSH file support for local device group.
2021-05-24 18:26:54 -04:00
startRelayConnection(parent.parent.encodeCookie(cookieContent, parent.parent.loginCookieEncryptionKey));
}
});
});
return obj;
};
Many improvements to apprelay.js
2022-04-14 14:47:04 -04:00
// Check that the user has full rights on a relay device before allowing it.
function checkRelayRights(parent, domain, user, relayNodeId, func) {
if (relayNodeId == null) { func(true); return; } // No relay, do nothing.
parent.GetNodeWithRights(domain, user, relayNodeId, function (node, rights, visible) {
func((node != null) && (rights == 0xFFFFFFFF));
});
}