From 6531e40c0dd71d7a24231f858eef4d5d60a1c162 Mon Sep 17 00:00:00 2001
From: Ylian Saint-Hilaire <ysainthilaire@hotmail.com>
Date: Wed, 17 Jun 2020 10:28:54 -0700
Subject: [PATCH] Fixed agent tunnel unable to connect.

---
 agents/MeshCmd-signed.exe   | Bin 4314080 -> 4314080 bytes
 agents/MeshCmd64-signed.exe | Bin 3929056 -> 3929056 bytes
 agents/meshcore.js          |   3 ++-
 meshdesktopmultiplex.js     |   4 ++--
 webserver.js                |   5 ++++-
 5 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/agents/MeshCmd-signed.exe b/agents/MeshCmd-signed.exe
index 29afc341bc3de8c76f94a138496fae26b248be3a..eb7f2df650e56701215eff8cbcf2fa9fa450f9f8 100644
GIT binary patch
delta 816
zcmW;53osJ^7yw}NXxa?JyrOvvV;<SC5e{_==TUU-gysFnGdir@Na#G5=SeraBV@?i
zMW}?FM-ENlh<TknDw3rB`tH7^r<uY_usH@H@*>4PJsy!6kN8&@ia=2)2G2kw6o+Ra
z3ZkI|#6U?X1*IVt%0O8t2XRmyDnLc31eM`Ar~*~td5DK<P#tPOO{fL6p$^oA7oZ;0
zhX#-U4WSVvLStwGO`#dQ2+bi0lA#5(gjSFOsn8nQz)R4!Gag}wo<x#O$fhI{)6$Ih
zcGsB>B|kiKg-Z{%S*PB7RAlP|_Y~Ia+7&(PWE_`o*7B2DU0^H}ID*oSNZ|T1B9XUT
zSBc1mT#X6-x4uNWAh=;H^JKn_K67a0N#E!FHWhF`dV8}m+4wmFOjeXzV=XShhre)J
zL2d7)o2dO|v+x2!Bd4T0+UpAs&0f%CZcPh#96E>ByeiwJsf(+m1mLQ=W(P*LI|{KZ
z71fY?gDXlqh3?oM4}??@CWUR=a-ta4>5LJuo$5BtgQG(=_G+dJ6WIDJfuknDxroN3
z$tCAM$6AtBNRIL@h@|^|O-)bMTxX>E{evs~c{)utS~&|ELvON|7nO@EnT6HubGeFr
z5=LlBEa_R2pus0Ge0iPPenWEf`xG6|+Sa-`6(lyTw2`&%QCAyLH82?GJm<yfrHz*w
zjs9A9rCoD7h)a!i=rLpD=NKG4P}X(if8ur=1*5MX<Gp-lYm8PGTNQ+G;>)AD^}C{$
zTZ$B-0Wm}JZF+yyW>^dJ^sqej)VNbi9WlJYZmAEkR<Tg?FSB`dN8Kr7DPYF1w3}u)
z*sJ|6EbS<?VQqJ~BF2{?H@`EHM1PnNSWIYJQ7EpuTUK!(O`V<0d*oC`M6Eq$B<kTx
xK6EpN(vUhSW3-J}E+@}qa(iTa{L1H@7(ar%%OCPrV#RTJ(GIHIR;EtqzrV3%SjPYW

delta 816
zcmW;5YcLZ4902fUWSKlSBF&hgJjXVM(K>`(MwjbcO9~5}-E5VkG;C}h*ICCr&W4Dq
zJSIXPq)1N8D{-gREysuHVjU%=^snFDPungr&_Wdtfz&TCL;{3FfcVz{BB3EPf(M~7
zM8QMQ1froSJPggCIkbS5&<a{Z48%ekXbX=(J7^D&LI-#Z;-DkMLnr7A3D5-+p(}KQ
z?(jG~0X?86^n%{d2l_%1^n?D83@MNb17IMe!5|n6Lm(Z7!Z3JpK!9MNXN{@86jA`0
zR8u_1NDyK>M7+W6fY*uG$k?Lv9;;gf%<^xKXODbF#gm_8+v2lt>UVHOOSA22I<1W*
zIb+?#&AZ<<aLiv*E060R+}gV~p1!%WT}k8Evh#m6^vbi5FH$oIcuh_rDptkEtjhJB
z6qUrh%;-T^`1vckkapZ{v5b?QBpe|j<B7uH>6=W%$a?s0G~#OMR6L7Uqnx+3C)T5?
z?)0(kWz7WAyOPIY3Y(qfD)}j#apPpGJ7cn|uQh&i=0?Yws>oqc;UY0vF~wJM8dK-7
zW{Wx;t9If~5cU<8l1m}9eGyR6o+;ds8A`$1iz3H59hH?M)n?3j4UJAHKY9z#HSN>s
zf}N~_OrrIK6<<FumNLhxsp{g(_;vC3t&Nt2C~l1OYm26k&kP?(m2FGyI<-Ct<3i~Q
z0>{d$8=P`icJ!C6C&cL6#Fx0`h7aR<>z|_%qnmByPNCXe+O$xJ(H4Cp_n4>XiJ^8<
zS8cwju6Cb~>=s2>WC|4#`W5xP($NcxFJ}#gL~N1fN6LWZQ%5sFTXKHG))-?g+qrxp
zwS+R9#t&YfNlucgbM7)V#k=pHWGy-9R#_I;(bao--8NjOD&9{w_mI!1zzhyT=QpJ$
u%ja^VSc+0SCHr)9N@iplKD~iG7)uw=Rw!s2xC)CLWr<1ehheh=|NR9ry;kY~

diff --git a/agents/MeshCmd64-signed.exe b/agents/MeshCmd64-signed.exe
index 439727471c6a64f3272fc63bd3e4027cd653f9af..249a904aaf8dc89adb00695254d100fc99784311 100644
GIT binary patch
delta 791
zcmW;5doa@h902e}C2V1AD?&8SHu+(G3^DIW+8>US(w&i$M<a6Gu9YUVWO>^m$F=VA
zCOL_dJH&KGcjQNRGs!yS87ri3eeOQ;#Z{afw%o_5iGv<y;c~KY|EfWCco-gmN1+Bh
z1~s7;)P{ISfXAT@)P;JG2=$=>BtbHyz!UH!G=xU*6f}k=&=j7AX3!j-fmCP#Euj^(
zhBnX^o`p0>hj#EBw1)_EfR4}!GN3a=p$l|{%+4&F+uo`Mil7e82%{`}-7Sny8=Oz@
ziqfNgiX|#nW;0$F6u4JcHrivu7359DfY62$pHlWyT6|td;yad4pmZfRwPcL)My$-H
zIY_2)T3%0#D-RRoI{IO(uTiy)tujGPc~S`Zx%Z7dS$BB!aPJfoEs!81o}qY3wnbpj
zmui;h4-!jUe{F%ZoAZ*de}|(~`mlu;BI5dy;F17Er0C}3)N)dH?fe4UA%05qs&?#8
zLW9K6S8szcGk_`skXRu;Td*T9>dzisQtaF6OP}CNM19FyIfzFo-l%@(8QV#5@U-iF
zlf-RNq}|(@DGnUpLi2yIQnB8ocRW^Kq#ZYPlG_=mxxB&`lCtRjGx_DsM0daW9o2*-
zRWRRExaNJCi+z)M+lnXWJaprmz0%env~`4BF_&uJEzNDOk`kw1l!VDB)T*{7Lh$Wz
z&c#FRwUs97>2urF4ZeLEHALaPeCE_u5u>ZV?)t6ClyQyjNaHe$nl!OuKp{=}4=s_y
z4HvmV{5<p{FPSOh7q>2l(t;8<F0I?G5NzmJ&Rl!M(lFM_Rw)Z);?LwAw%G!vk5h$_
zXX$C$G=a<JhY^)qPi~&=T0)UWH)l{nGu^jnirrqKm6ws4r=!!`x7^=2F$#4nhC1Fd
j29~YKp}z@nb>ZI;pO{@!)Q|RP<UnqrWt424cj&*r)ec+<

delta 791
zcmW;5doU9K8~|XOWFE=;&Ai{_F=G@$wPQKQWHfKudHo@e9?Do|n{bD*>pDV1<uM}0
zw4`zu*G{=)l`KkUJMET;l={_o_es9U5fV61jzHdQx<*4VXo!E2P#GS8D)1mwg(#>7
z)u9H|gomIOJPfs=4%CHuP#+pVLudqzp$RmFX3!j3Kud^*R?r&SKwD@B?V$s7gig>I
zx<FUx2Hl|tJOVwT7xacc5CeT77WzSdh=T#6G(_MpxhmGv*UJxs;m{R<anz*VS!QFW
zop;7+ONrcb#10d;B}oyJ^1D)MyO|S{!ov0`TK$4!jWj&sf<Y5&)BfIbUVG&zq3T^?
zZrS2}xpIV|<iVM0^5eRSmAU}yWu;8v?yMytcx5{zuwl-fY`TX|x4GU>9Lo!m8U5gv
zsw3ul6q|Uwt^D$_)Bz!ND?sxpMgJw+C^S-3zPEDL*MBgfkKa|7X3@wJA2iN>gH|fi
z!beYstySz)NUO?Pwxf7`ohIGrJC(yY{*&zYd8iSTD65T_aKe>tJ1w*^PTIk4VY6`l
z1@X%ohCRK-PRR>x7lS;8$07>LC$*g-V~#5Zn#rcEQq|FqdsLgHIy&-p-^?n(>q_ca
z32LJ|w4+{3lF&451ubi*a|E=hK`YKc|0&To*~8FT?eEUX_F{|eM4bgB?zLzvzs)Lz
zTS+R)d-j4EPF%b+M9CPADB9mWmvAyFoy9gFbf_gP5jh_?idVYxiIjbYUOUB%5#`oI
zqbv4e2#=`MpNLYy(9!hP4aFL7#>yeJpUMu)c5j#!d}Vj@Id-x1w5!CL9AzgL9h8)h
z^*OKC8#;bNhMQj<7xObJ2)X^-^*^PJmPpcDv!t0@GK_J~dPj5h-9n~Hd`<M)ymX`q
nUqBgQZR7?fk|#PcwS&n)Aq=jG`RCf<*!bV-0bxJemHzt+wN6;2

diff --git a/agents/meshcore.js b/agents/meshcore.js
index d52c5fff..197627b9 100644
--- a/agents/meshcore.js
+++ b/agents/meshcore.js
@@ -688,6 +688,7 @@ function createMeshCore(agent) {
                                 // Create a new tunnel object
                                 var xurl = getServerTargetUrlEx(data.value);
                                 if (xurl != null) {
+                                    xurl = xurl.split('$').join('%24').split('@').join('%40'); // Escape the $ and @ characters
                                     var woptions = http.parseUri(xurl);
                                     woptions.rejectUnauthorized = 0;
                                     //sendConsoleText(JSON.stringify(woptions));
@@ -2892,7 +2893,7 @@ function createMeshCore(agent) {
                     } else {
                         var httprequest = null;
                         try {
-                            var options = http.parseUri(args['_'][0]);
+                            var options = http.parseUri(args['_'][0].split('$').join('%24').split('@').join('%40')); // Escape the $ and @ characters in the URL
                             options.rejectUnauthorized = 0;
                             httprequest = http.request(options);
                         } catch (e) { response = 'Invalid HTTP websocket request'; }
diff --git a/meshdesktopmultiplex.js b/meshdesktopmultiplex.js
index 33e993a4..91715b14 100644
--- a/meshdesktopmultiplex.js
+++ b/meshdesktopmultiplex.js
@@ -93,7 +93,7 @@ function CreateDesktopMultiplexor(parent, domain, nodeid, func) {
 
     // Add an agent or viewer
     obj.addPeer = function (peer) {
-        if (obj.viewers == null) return;
+        if (obj.viewers == null) { parent.parent.debug('relay', 'DesktopRelay: Error, addingPeer on disposed session'); return; }
         if (peer.req.query.browser) {
             //console.log('addPeer-viewer', obj.nodeid);
                         
@@ -138,7 +138,7 @@ function CreateDesktopMultiplexor(parent, domain, nodeid, func) {
             obj.sendSessionMetadata();
         } else {
             //console.log('addPeer-agent', obj.nodeid);
-            if (obj.agent != null) return false;
+            if (obj.agent != null) { parent.parent.debug('relay', 'DesktopRelay: Error, duplicate agent connection'); return false; }
             
             // Setup the agent
             obj.agent = peer;
diff --git a/webserver.js b/webserver.js
index d94f6847..4ac2abc9 100644
--- a/webserver.js
+++ b/webserver.js
@@ -4270,6 +4270,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
             parent.debug('webrequest', '(' + req.clientIp + ') ' + req.url);
             res.removeHeader('X-Powered-By');
 
+            // Skip the rest is this is an agent connection
+            if ((req.url.indexOf('/meshrelay.ashx/.websocket') >= 0) || (req.url.indexOf('/agent.ashx/.websocket') >= 0)) { next(); return; }
+
             // If this domain has configured headers, use them.
             // Example headers: { 'Strict-Transport-Security': 'max-age=360000;includeSubDomains' };
             //                  { 'Referrer-Policy': 'no-referrer', 'x-frame-options': 'SAMEORIGIN', 'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src http: ws: data: 'self';script-src http: 'unsafe-inline';style-src http: 'unsafe-inline'" };
@@ -4293,7 +4296,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
             if ((req.session.ip != null) && (req.clientIp != null) && (req.session.ip != req.clientIp)) { req.session = {}; }
 
             // Extend the session time by forcing a change to the session every minute.
-            req.session.nowInMinutes = Math.floor(Date.now() / 60e3);
+            if (req.session.userid != null) { req.session.nowInMinutes = Math.floor(Date.now() / 60e3); } else { delete req.session.nowInMinutes; }
 
             // Detect if this is a file sharing domain, if so, just share files.
             if ((domain != null) && (domain.share != null)) {