Fabio/webssh2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: pull in #234 staged for 0.4.0 #242

Browse source
This commit is contained in:
Bill Church 2021-05-17 20:37:17 +00:00
parent 304a3db1c8
commit fd59c1d0bd
1 changed files with 225 additions and 200 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
app/server/socket.js
View file

@ -9,6 +9,9 @@ const debug = require('debug');
const debugWebSSH2 = require('debug')('WebSSH2'); const debugWebSSH2 = require('debug')('WebSSH2');
const SSH = require('ssh2').Client; const SSH = require('ssh2').Client;
const CIDRMatcher = require('cidr-matcher'); const CIDRMatcher = require('cidr-matcher');
const validator = require('validator');
const dnsPromises = require('dns').promises;
// var fs = require('fs') // var fs = require('fs')
// var hostkeys = JSON.parse(fs.readFileSync('./hostkeyhashes.json', 'utf8')) // var hostkeys = JSON.parse(fs.readFileSync('./hostkeyhashes.json', 'utf8'))
let termCols; let termCols;
@ -16,6 +19,7 @@ let termRows;
// public // public
module.exports = function appSocket(socket) { module.exports = function appSocket(socket) {
async function setupConnection() {
// if websocket connection arrives without an express session, kill it // if websocket connection arrives without an express session, kill it
if (!socket.request.session) { if (!socket.request.session) {
socket.emit('401 UNAUTHORIZED'); socket.emit('401 UNAUTHORIZED');
@ -70,13 +74,32 @@ module.exports = function appSocket(socket) {
(((socket.request.session || {}).ssh || {}).allowedSubnets || {}).length && (((socket.request.session || {}).ssh || {}).allowedSubnets || {}).length &&
socket.request.session.ssh.allowedSubnets.length > 0 socket.request.session.ssh.allowedSubnets.length > 0
) { ) {
const matcher = new CIDRMatcher(socket.request.session.ssh.allowedSubnets); let ipaddress = socket.request.session.ssh.host;
if (!matcher.contains(socket.request.session.ssh.host)) { if (!validator.isIP(`${ipaddress}`)) {
try {
const result = await dnsPromises.lookup(socket.request.session.ssh.host);
ipaddress = result.address;
} catch (err) {
console.error( console.error(
`WebSSH2 ${'error: Requested host outside configured subnets / REJECTED'.red.bold} user=${ `WebSSH2 ${`error: ${err.code} ${err.hostname}`.red.bold} user=${
socket.request.session.username.yellow.bold.underline socket.request.session.username.yellow.bold.underline
} from=${socket.handshake.address.yellow.bold.underline}` } from=${socket.handshake.address.yellow.bold.underline}`
); );
socket.emit('ssherror', '404 HOST IP NOT FOUND');
socket.disconnect(true);
return;
}
}
const matcher = new CIDRMatcher(socket.request.session.ssh.allowedSubnets);
if (!matcher.contains(ipaddress)) {
console.error(
`WebSSH2 ${
`error: Requested host ${ipaddress} outside configured subnets / REJECTED`.red.bold
} user=${socket.request.session.username.yellow.bold.underline} from=${
socket.handshake.address.yellow.bold.underline
}`
);
socket.emit('ssherror', '401 UNAUTHORIZED'); socket.emit('ssherror', '401 UNAUTHORIZED');
socket.disconnect(true); socket.disconnect(true);
return; return;
@ -234,4 +257,6 @@ module.exports = function appSocket(socket) {
socket.request.session.destroy(); socket.request.session.destroy();
socket.disconnect(true); socket.disconnect(true);
} }
}
setupConnection();
}; };