MeshCentral/redirserver.js

162 lines
7.7 KiB
JavaScript
Raw Normal View History

2017-08-28 19:27:45 +03:00
/**
* @description Meshcentral web server
* @author Ylian Saint-Hilaire
2020-01-03 05:30:12 +03:00
* @copyright Intel Corporation 2018-2020
2018-01-04 23:15:21 +03:00
* @license Apache-2.0
2018-08-30 03:40:30 +03:00
* @version v0.0.2
2017-08-28 19:27:45 +03:00
*/
2018-08-30 03:40:30 +03:00
/*jslint node: true */
/*jshint node: true */
/*jshint strict:false */
/*jshint -W097 */
/*jshint esversion: 6 */
"use strict";
2018-08-27 22:24:15 +03:00
2017-08-28 19:27:45 +03:00
// ExpressJS login sample
// https://github.com/expressjs/express/blob/master/examples/auth/index.js
// Construct a HTTP redirection web server object
module.exports.CreateRedirServer = function (parent, db, args, func) {
2017-08-28 19:27:45 +03:00
var obj = {};
obj.parent = parent;
obj.db = db;
obj.args = args;
obj.certificates = null;
2019-11-14 09:47:17 +03:00
obj.express = require('express');
obj.net = require('net');
2017-08-28 19:27:45 +03:00
obj.app = obj.express();
2018-08-30 03:40:30 +03:00
obj.tcpServer = null;
obj.port = null;
2019-11-14 09:47:17 +03:00
const leChallengePrefix = '/.well-known/acme-challenge/';
2018-08-30 03:40:30 +03:00
2017-08-28 19:27:45 +03:00
// Perform an HTTP to HTTPS redirection
function performRedirection(req, res) {
var host = req.headers.host;
2019-10-26 02:32:09 +03:00
if (typeof host == 'string') { host = host.split(":")[0]; }
if ((host == null) && (obj.certificates != null)) { host = obj.certificates.CommonName; if (obj.certificates.CommonName.indexOf('.') == -1) { host = req.headers.host; } }
2018-03-09 04:58:22 +03:00
var httpsPort = ((obj.args.aliasport == null) ? obj.args.port : obj.args.aliasport); // Use HTTPS alias port is specified
2019-10-26 02:32:09 +03:00
res.redirect("https://" + host + ":" + httpsPort + req.url);
2017-08-28 19:27:45 +03:00
}
2018-08-30 03:40:30 +03:00
/*
2017-08-28 19:27:45 +03:00
// Return the current domain of the request
function getDomain(req) {
2018-08-30 03:40:30 +03:00
var x = req.url.split("/");
if (x.length < 2) { return parent.config.domains[""]; }
if (parent.config.domains[x[1].toLowerCase()]) { return parent.config.domains[x[1].toLowerCase()]; }
return parent.config.domains[""];
2017-08-28 19:27:45 +03:00
}
2018-08-30 03:40:30 +03:00
*/
2017-08-28 19:27:45 +03:00
// Renter the terms of service.
2019-11-14 09:47:17 +03:00
obj.app.get('/MeshServerRootCert.cer', function (req, res) {
2018-11-30 04:59:29 +03:00
// The redirection server starts before certificates are loaded, make sure to handle the case where no certificate is loaded now.
if (obj.certificates != null) {
2020-10-02 23:17:53 +03:00
res.set({ 'Cache-Control': 'no-store', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename="' + obj.certificates.RootName + '.cer"' });
2018-11-30 04:59:29 +03:00
var rootcert = obj.certificates.root.cert;
2019-11-14 09:47:17 +03:00
var i = rootcert.indexOf('-----BEGIN CERTIFICATE-----\r\n');
2018-11-30 04:59:29 +03:00
if (i >= 0) { rootcert = rootcert.substring(i + 29); }
2019-11-14 09:47:17 +03:00
i = rootcert.indexOf('-----END CERTIFICATE-----');
2018-11-30 04:59:29 +03:00
if (i >= 0) { rootcert = rootcert.substring(i, 0); }
res.send(Buffer.from(rootcert, "base64"));
2018-11-30 04:59:29 +03:00
} else {
res.sendStatus(404);
}
2017-08-28 19:27:45 +03:00
});
// Add HTTP security headers to all responses
obj.app.use(function (req, res, next) {
2019-11-14 09:47:17 +03:00
parent.debug('webrequest', req.url + ' (RedirServer)');
res.removeHeader('X-Powered-By');
if ((parent.letsencrypt != null) && (req.url.startsWith(leChallengePrefix))) {
// Let's Encrypt Support
parent.letsencrypt.challenge(req.url.slice(leChallengePrefix.length), getCleanHostname(req), function (response) { if (response == null) { res.sendStatus(404); } else { res.send(response); } });
} else {
// Everything else
var selfurl = ((args.notls !== true) ? (' wss://' + req.headers.host) : (' ws://' + req.headers.host));
res.set({
'strict-transport-security': 'max-age=60000; includeSubDomains',
'Referrer-Policy': 'no-referrer',
'x-frame-options': 'SAMEORIGIN',
'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff',
'Content-Security-Policy': "default-src 'none'; style-src 'self' 'unsafe-inline';"
});
2019-11-14 09:47:17 +03:00
return next();
}
2017-08-28 19:27:45 +03:00
});
// Once the main web server is started, call this to hookup additional handlers
obj.hookMainWebServer = function (certs) {
obj.certificates = certs;
for (var i in parent.config.domains) {
if (parent.config.domains[i].dns != null) { continue; }
var url = parent.config.domains[i].url;
2018-08-30 03:40:30 +03:00
obj.app.post(url + "amtevents.ashx", obj.parent.webserver.handleAmtEventRequest);
obj.app.get(url + "meshsettings", obj.parent.webserver.handleMeshSettingsRequest);
obj.app.get(url + "meshagents", obj.parent.webserver.handleMeshAgentRequest);
// Server redirects
if (parent.config.domains[i].redirects) {
for (var j in parent.config.domains[i].redirects) {
if (j[0] != '_') { obj.app.get(url + j, obj.parent.webserver.handleDomainRedirect); }
}
}
}
}
2017-08-28 19:27:45 +03:00
// Setup all HTTP redirection handlers
2018-08-30 03:40:30 +03:00
//obj.app.set("etag", false);
for (var i in parent.config.domains) {
if (parent.config.domains[i].dns != null) { continue; }
2017-08-28 19:27:45 +03:00
var url = parent.config.domains[i].url;
obj.app.get(url, performRedirection); // Root redirection
obj.app.get(url + 'player.htm', performRedirection); // Player redirection
obj.app.use(url + 'clickonce', obj.express.static(obj.parent.path.join(__dirname, "public/clickonce"))); // Indicates the clickonce folder is public
// Setup all of the redirections to HTTPS
const redirections = ['terms', 'logout', 'MeshServerRootCert.cer', 'mescript.ashx', 'checkmail', 'agentinvite', 'messenger', 'meshosxagent', 'devicepowerevents.ashx', 'downloadfile.ashx', 'userfiles/*', 'webrelay.ashx', 'health.ashx', 'logo.png', 'welcome.jpg'];
for (i in redirections) { obj.app.get(url + redirections[i], performRedirection); }
2017-08-28 19:27:45 +03:00
}
2018-08-30 03:40:30 +03:00
2017-08-28 19:27:45 +03:00
// Find a free port starting with the specified one and going up.
function CheckListenPort(port, addr, func) {
2017-08-28 19:27:45 +03:00
var s = obj.net.createServer(function (socket) { });
obj.tcpServer = s.listen(port, addr, function () { s.close(function () { if (func) { func(port, addr); } }); }).on("error", function (err) {
if (args.exactports) { console.error("ERROR: MeshCentral HTTP server port " + port + " not available."); process.exit(); }
else { if (port < 65535) { CheckListenPort(port + 1, addr, func); } else { if (func) { func(0); } } }
2017-08-28 19:27:45 +03:00
});
}
// Start the ExpressJS web server, if the port is busy try the next one.
function StartRedirServer(port, addr) {
2018-08-30 03:40:30 +03:00
if (port == 0 || port == 65535) { return; }
obj.tcpServer = obj.app.listen(port, addr, function () {
obj.port = port;
console.log("MeshCentral HTTP redirection server running on port " + port + ".");
obj.parent.authLog('http', 'Server listening on ' + ((addr != null)?addr:'0.0.0.0') + ' port ' + port + '.');
2020-02-17 21:24:32 +03:00
obj.parent.updateServerState('redirect-port', port);
func(obj.port);
2020-02-17 21:24:32 +03:00
}).on('error', function (err) {
if ((err.code == 'EACCES') && (port < 65535)) { StartRedirServer(port + 1); } else { console.log(err); func(obj.port); }
});
2017-08-28 19:27:45 +03:00
}
2018-08-30 03:40:30 +03:00
2019-11-14 09:47:17 +03:00
// Get the remote hostname correctly
const servernameRe = /^[a-z0-9\.\-]+$/i;
function getHostname(req) { return req.hostname || req.headers['x-forwarded-host'] || (req.headers.host || ''); };
function getCleanHostname(req) {
var servername = getHostname(req).toLowerCase().replace(/:.*/, '');
try { req.hostname = servername; } catch (e) { } // read-only express property
if (req.headers['x-forwarded-host']) { req.headers['x-forwarded-host'] = servername; }
try { req.headers.host = servername; } catch (e) { }
return (servernameRe.test(servername) && -1 === servername.indexOf('..') && servername) || '';
};
CheckListenPort(args.redirport, args.redirportbind, StartRedirServer);
2017-08-28 19:27:45 +03:00
return obj;
2018-08-30 03:40:30 +03:00
};