Fabio/webssh2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move to cidr-matcher

Browse source 
Signed-off-by: Matt Oswalt <matt@keepingitclassless.net>
This commit is contained in:
Matt Oswalt 2019-11-23 01:02:24 -08:00
parent 65af8fea4f
commit ce579781e8
No known key found for this signature in database
GPG key ID: 90EBA1B26A6D1061
2 changed files with 8 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/package.json
View file

@ -42,7 +42,7 @@
"xterm-addon-fit": "^0.3.0", "xterm-addon-fit": "^0.3.0",
"xterm-addon-search": "^0.3.0", "xterm-addon-search": "^0.3.0",
"xterm-addon-web-links": "^0.2.1", "xterm-addon-web-links": "^0.2.1",
"netmask": "1.0.6" "cidr-matcher": "2.1.1"
}, },
"scripts": { "scripts": {
"start": "node index.js", "start": "node index.js",

21
app/server/socket.js
View file

@ -6,7 +6,7 @@
var debug = require('debug') var debug = require('debug')
var debugWebSSH2 = require('debug')('WebSSH2') var debugWebSSH2 = require('debug')('WebSSH2')
var SSH = require('ssh2').Client var SSH = require('ssh2').Client
var Netmask = require('netmask').Netmask var CIDRMatcher = require('cidr-matcher');
// var fs = require('fs') // var fs = require('fs')
// var hostkeys = JSON.parse(fs.readFileSync('./hostkeyhashes.json', 'utf8')) // var hostkeys = JSON.parse(fs.readFileSync('./hostkeyhashes.json', 'utf8'))
var termCols, termRows var termCols, termRows
@ -25,19 +25,12 @@ module.exports = function socket (socket) {
// If configured, check that requsted host is in a permitted subnet // If configured, check that requsted host is in a permitted subnet
if (socket.request.session.ssh.allowedSubnets.length > 0) { if (socket.request.session.ssh.allowedSubnets.length > 0) {
var permitted = false; var matcher = new CIDRMatcher(socket.request.session.ssh.allowedSubnets);
for (const subnet of socket.request.session.ssh.allowedSubnets) { if (!matcher.contains(socket.request.session.ssh.host)) {
var subnetBlock = new Netmask(subnet); socket.emit('401 UNAUTHORIZED')
if (subnetBlock.contains(socket.request.session.ssh.host)) { debugWebSSH2('SOCKET: Requested host outside configured subnets / REJECTED')
permitted = true; socket.disconnect(true)
break; return
}
}
if (!permitted) {
socket.emit('401 UNAUTHORIZED')
debugWebSSH2('SOCKET: Requested host outside configured subnets / REJECTED')
socket.disconnect(true)
return
} }
} }