@iasiv5/dsh-obmc-web 0.1.1 → 0.1.3

package/README.md

@@ -1,6 +1,7 @@
 # @iasiv5/dsh-obmc-web
 
-在 DSH GUI 里使用 **BMC Web UI**（OpenBMC / bmcweb，AST2700 EVB 实测）。
+在 DSH GUI 里使用 **BMC Web UI**（OpenBMC / bmcweb，AST2700 EVB 实测；
+插件本体于 DSH Web `0.1.7-rc.2` 实测）。
 host 半身在 DSH web 服务器的 GUI origin 上注册一组同源代理路由，经
 `obmc-web-relay.service`（SSH 本地转发，仅绑 `127.0.0.1`，端口默认
 18443、被占自动顺延）抵达 BMC；client 半身仿照 dsh-surf，在「设置」
@@ -104,7 +105,8 @@ BMC 地址常由跳板侧 DHCP 动态分配，可能变化。当隧道目标失
 报错，或 `/bmc-status?probe=1` 实测失败）时，插件自动 SSH 到跳板机定位
 bmcweb 实际地址：先查 dnsmasq 租约表 + ARP 表（单纯换址时亚秒级返回），
 不通再对候选网段做 TCP-443 扫描；候选地址以 `/redfish/v1` 应答做指纹
-校验（200 或 401 都算 bmcweb 在场）。探测网段的确定顺序：配置的
+校验（200 需带 `"RedfishVersion"` 服务签名；401 保留原判；当选后的
+TLS 证书另经 TOFU 钉扎，见「安全说明」）。探测网段的确定顺序：配置的
 `OBMC_SUBNET` → `BMC_TARGET` IP 的 /24 → 跳板机自身枚举的直连 IPv4
 网段。找到后写回 env 文件的 `BMC_TARGET` 行、经 user manager 重启
 relay，并通过隧道验证后才报告成功；若 relay unit 尚未安装（首次
@@ -121,8 +123,29 @@ bootstrap），地址仍会写入配置并提示下一步去点「安装并启
 - 上游仅 `127.0.0.1`（SSH 隧道，端口默认 18443），不新增任何公网监听。
 - 剥掉的响应头：`X-Frame-Options`、`Strict-Transport-Security`、
   `WWW-Authenticate`（防止 bmcweb 的 401 Basic challenge 弹浏览器原生
-  凭据框；BMC SPA 走 POST /login JSON + cookie），CSP 仅移除
-  `frame-ancestors` 指令；其余（含 Cookie）原样透传。
+  凭据框；BMC SPA 走 POST /login JSON + cookie）、`Clear-Site-Data`
+  （bmcweb 登出会发 `Clear-Site-Data: "cache","cookies","storage"`，语义
+  是清空整个源的 Cookie 与存储——在同源代理下会连带清掉 GUI 自身的会话
+  Cookie，把 DSH 一起登出；BMC 侧登出不受影响：显式的 `SESSION=` 过期
+  Set-Cookie 照常透传，服务端会话照常销毁），CSP 仅移除
+  `frame-ancestors` 指令；其余响应头原样透传。
+- 上行 Cookie 白名单（0.1.3 起）：GUI 源的 Cookie 不再整串透传给
+  BMC——只有 bmcweb 自己的 `SESSION` / `XSRF-TOKEN` 允许跨隧道，其余
+  （尤其 DSH 会话 Cookie `__Host-dsh_auth_session`）在上行前剥离，
+  BMC 这个信任域永远收不到 DSH 会话。
+- BMC TLS 证书 TOFU 钉扎（0.1.3 起）：隧道对端的自签证书按 `BMC_TARGET`
+  记录 SHA-256 指纹（`~/.config/systemd/user/obmc-relay-trust.json`，
+  `OBMC_WEB_TRUST` 可改址），首次见到即钉扎；此后指纹不符的交换会被
+  502 拒绝、旧指纹作废、下一次请求重新钉扎——静默中间人最多拿到一次
+  被拒的交换，且拿不到 Cookie。BMC 侧重生成证书同样自动重钉扎；如需
+  彻底重置删除上述文件即可。WS（KVM/控制台）路径同受保护——顺带修复
+  了该路径调用不存在的 `https.connect` 导致首个升级请求即崩的问题。
+- 非 `/login` 的上游 401 统一降级为 403：BMC SPA 的 axios 拦截器对其他
+  401 会执行 `window.location = "/login"`——根绝对路径的顶层导航，在
+  同源代理下会逃出 `/bmc` 前缀，落到 GUI 自己的 `/login` 并被认证门
+  重定向进 DSH 应用，把用户从 BMC 控制台拽走（首次打开最常见）。403
+  走 SPA 的原地「未授权」提示，不发生导航；`/login` 的真实 401 保留
+  （登录表单错误处理与 CSRF 探测依赖它）。
 - 不在任何地方存储 BMC 凭据；登录在 BMC 自身页面完成。
 - 信任围栏仿照 dsh-better-sidebar 的 trust-fence（Host 必须是 loopback
   或部署信任的 authority、`Sec-Fetch-Site` 不得为 cross-site、Origin 若有

package/lib/index.js

@@ -10,11 +10,16 @@
  * after its own exact table, so the GUI's own longer routes always win and
  * a duplicate registration is skipped (never throws the plugin).
  *
- * Embed-hostile response headers are removed (X-Frame-Options, HSTS,
- * CSP frame-ancestors — and WWW-Authenticate, so bmcweb's 401 Basic
- * challenges can never pop the browser's native credential dialog; the BMC
- * SPA logs in via POST /login JSON + cookie). Everything else passes
- * through untouched; no credentials are stored anywhere.
+ * Embed-hostile and origin-hostile response headers are removed
+ * (X-Frame-Options, HSTS, CSP frame-ancestors, WWW-Authenticate so bmcweb's
+ * 401 Basic challenges can never pop the browser's native credential
+ * dialog — the BMC SPA logs in via POST /login JSON + cookie — and
+ * Clear-Site-Data, whose origin-wide wipe on BMC logout would otherwise
+ * destroy the GUI's session cookie). Non-/login 401s are degraded
+ * to 403: the BMC SPA redirects the whole tab to root-absolute /login on
+ * any other 401, which on this origin lands in the GUI's auth gate and
+ * bounces the browser into the DSH app. Everything else passes through
+ * untouched; no credentials are stored anywhere.
  *
  * BMC address discovery: the BMC's address is often DHCP-assigned by the
  * jump host that links it (a small LAN of its own) and may change. When
@@ -47,6 +52,7 @@
  */
 import https from 'node:https'
 import net from 'node:net'
+import tls from 'node:tls'
 import { execFile, spawn } from 'node:child_process'
 import fs from 'node:fs'
 import os from 'node:os'
@@ -86,7 +92,18 @@ const HOP = new Set([
 // www-authenticate is dropped so bmcweb's 401 Basic challenges (e.g. on
 // /login and unknown paths) can never pop the browser's native credential
 // dialog — the BMC SPA logs in via POST /login JSON + cookie, not Basic.
-const DROP_RESPONSE = new Set([...HOP, 'x-frame-options', 'strict-transport-security', 'www-authenticate'])
+// clear-site-data is dropped because bmcweb's logout answers
+// Clear-Site-Data: "cache","cookies","storage" — an instruction to wipe
+// EVERY cookie/cache/storage entry for the ORIGIN. Through this same-origin
+// proxy that origin is the GUI's: one BMC logoff would otherwise destroy
+// the DSH session cookie (and DSH's localStorage) too. BMC-side logout
+// still works without it: bmcweb expires its SESSION cookie via an
+// explicit Set-Cookie (passes through) and destroys the session
+// server-side; only the origin-wide nuke is suppressed.
+const DROP_RESPONSE = new Set([
+  ...HOP, 'x-frame-options', 'strict-transport-security', 'www-authenticate',
+  'clear-site-data',
+])
 
 const agent = new https.Agent({ keepAlive: true, maxSockets: 8, rejectUnauthorized: false })
 
@@ -323,7 +340,14 @@ for f in $lease_files; do
 done
 cands="$cands $(ip neigh show 2>/dev/null | awk '{print $1}' | grep -E '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)' | head -100)"
 cands=$(printf '%s\\n' $cands | sort -u)
-check() { code=$(curl -k -m 3 -s -o /dev/null -w '%{http_code}' "https://$1/redfish/v1" 2>/dev/null); [ "$code" = 200 ] || [ "$code" = 401 ]; }
+check() {
+  resp=$(curl -k -m 3 -s -w '\\n%{http_code}' "https://$1/redfish/v1" 2>/dev/null)
+  code=\${resp##*$'\\n'}
+  body=\${resp%$'\\n'*}
+  [ "\$code" = 200 ] && printf '%s' "\$body" | grep -q '"RedfishVersion"' && return 0
+  [ "\$code" = 401 ] && return 0
+  return 1
+}
 for c in $cands; do
   if check "$c"; then echo "BMC_IP=$c"; exit 0; fi
 done
@@ -489,17 +513,124 @@ function cspWithoutFrameAncestors(value) {
     .join('; ')
 }
 
+// ── upstream trust domain hardening (audit 2026-09-28) ───────────────────
+// The relay tunnel crosses into the BMC's trust domain. Two exposures are
+// closed here:
+// 1. Cookie bleed: the GUI origin's cookies (notably the DSH session cookie
+//    __Host-dsh_auth_session) used to ride every proxied request to the
+//    BMC. Only bmcweb's own cookie names may cross now.
+// 2. TLS pinning (TOFU): the tunnel TLS terminates at the BMC's self-signed
+//    certificate. The first certificate seen for a BMC target is pinned to
+//    a trust file; a later mismatch is refused once, the stale pin dropped,
+//    and the next request re-pins — a silent MITM gets one refused exchange,
+//    never the session. Regenerated BMC certs re-enroll the same way.
+
+const TRUST_FILE = process.env.OBMC_WEB_TRUST
+  ?? path.join(os.homedir(), '.config/systemd/user/obmc-relay-trust.json')
+const UPSTREAM_COOKIE_ALLOW = new Set(['session', 'xsrf-token'])
+
+/** Keep only bmcweb's own cookie names; everything else never crosses. */
+export function filterUpstreamCookies(cookieHeader) {
+  if (cookieHeader === undefined || cookieHeader === null) return undefined
+  const kept = String(cookieHeader)
+    .split(';')
+    .map(part => part.trim())
+    .filter(part => {
+      if (part === '') return false
+      const eq = part.indexOf('=')
+      const name = (eq === -1 ? part : part.slice(0, eq)).trim().toLowerCase()
+      return UPSTREAM_COOKIE_ALLOW.has(name)
+    })
+  return kept.length === 0 ? undefined : kept.join('; ')
+}
+
+function loadTrustPins(file = TRUST_FILE) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'))
+    if (parsed && typeof parsed === 'object' && parsed.pins && typeof parsed.pins === 'object') {
+      return parsed
+    }
+  } catch { /* missing/corrupt → treat as empty (first use re-pins) */ }
+  return { pins: {} }
+}
+
+function writeTrustStore(store, file) {
+  fs.mkdirSync(path.dirname(file), { recursive: true })
+  const tmp = `${file}.tmp-${process.pid}`
+  fs.writeFileSync(tmp, JSON.stringify(store, null, 2) + '\n')
+  fs.renameSync(tmp, file)
+}
+
+export function saveTrustPin(target, fingerprint256, file = TRUST_FILE) {
+  const store = loadTrustPins(file)
+  store.pins[target] = fingerprint256
+  store.updatedAt = new Date().toISOString()
+  writeTrustStore(store, file)
+}
+
+function clearTrustPin(target, file = TRUST_FILE) {
+  const store = loadTrustPins(file)
+  if (store.pins[target] === undefined) return
+  delete store.pins[target]
+  store.updatedAt = new Date().toISOString()
+  writeTrustStore(store, file)
+}
+
+/**
+ * Build a checkServerIdentity-style validator for the tunnel TLS. TOFU:
+ * the first certificate seen for the configured BMC target is pinned; a
+ * later mismatch is refused once and the stale pin dropped (the next
+ * request re-enrolls). target=null (no BMC_TARGET in env) disables pinning.
+ */
+export function makeTlsPinChecker(target, file = TRUST_FILE) {
+  if (!target) return undefined
+  return (_host, cert) => {
+    const fp = cert?.fingerprint256
+    if (typeof fp !== 'string' || fp === '') return // nothing to pin on; do not fail the exchange
+    const pins = loadTrustPins(file).pins
+    const known = pins[target]
+    if (known === undefined) {
+      saveTrustPin(target, fp, file)
+      return
+    }
+    if (known !== fp) {
+      clearTrustPin(target, file)
+      throw new Error(`BMC TLS certificate for ${target} changed (TOFU pin mismatch) — pin dropped; next request re-enrolls`)
+    }
+  }
+}
+
 /** Forward one plain HTTP exchange to the BMC tunnel. */
 function proxyRequest(req, res, targetPath, log) {
   const headers = {}
   for (const [key, value] of Object.entries(req.headers)) {
-    if (HOP.has(key.toLowerCase()) || key.toLowerCase() === 'host') continue
+    const lower = key.toLowerCase()
+    if (HOP.has(lower) || lower === 'host' || lower === 'cookie') continue
     headers[key] = value
   }
   headers.host = `${UP_HOST}:${envConfig.relayPort}`
+  const cookie = filterUpstreamCookies(req.headers.cookie)
+  if (cookie !== undefined) headers.cookie = cookie
   const upstream = https.request(
-    { host: UP_HOST, port: envConfig.relayPort, method: req.method, path: targetPath, headers, agent },
+    {
+      host: UP_HOST, port: envConfig.relayPort, method: req.method, path: targetPath, headers, agent,
+    },
     (up) => {
+      // TOFU pin enforcement: with rejectUnauthorized:false Node skips
+      // checkServerIdentity entirely, so the pin is verified manually per
+      // exchange against the TLS socket's peer certificate (audit 2026-09-28).
+      const fp = up.socket?.getPeerCertificate?.(true)?.fingerprint256
+      try {
+        makeTlsPinChecker(envConfig.bmcTarget)?.(null, { fingerprint256: fp })
+      } catch (err) {
+        log?.warn?.(`[dsh-obmc-web] ${err.message}`)
+        up.destroy()
+        try {
+          res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+          res.end('dsh-obmc-web: BMC TLS certificate changed (TOFU pin mismatch) — pin dropped; the next request re-enrolls')
+        } catch { /* socket already gone */ }
+        return
+      }
       const raw = []
       for (let i = 0; i < up.rawHeaders.length; i += 2) {
         const key = up.rawHeaders[i]
@@ -514,7 +645,20 @@ function proxyRequest(req, res, targetPath, log) {
         }
         raw.push(key, value)
       }
-      res.writeHead(up.statusCode, raw)
+      // The BMC SPA's axios interceptor treats ANY 401 outside /login as
+      // "session lost" and answers with `window.location = "/login"` — a
+      // ROOT-ABSOLUTE navigation that escapes the /bmc prefix. On this
+      // origin /login belongs to the GUI's auth gate, which 307s such
+      // navigations into the DSH app, yanking the browser out of the BMC
+      // console entirely (seen on the first console open after a DSH
+      // restart: the SPA boots with stale localStorage login hints, probes
+      // /redfish/... while logged out, and the 401 bounce follows). Degrade
+      // every non-/login 401 to 403: the SPA's 403 path (setUnauthorized)
+      // is an in-place toast, never a navigation. /login keeps its true
+      // status so the login form's error handling and the CSRF probe keep
+      // working.
+      const status = up.statusCode === 401 && !/^\/login(\?|$)/.test(targetPath) ? 403 : up.statusCode
+      res.writeHead(status, raw)
       up.pipe(res)
     },
   )
@@ -535,11 +679,29 @@ function proxyRequest(req, res, targetPath, log) {
 function proxyUpgrade(req, socket, head, log) {
   const headers = {}
   for (const [key, value] of Object.entries(req.headers)) {
-    if (key.toLowerCase() === 'host') continue
+    const lower = key.toLowerCase()
+    if (lower === 'host' || lower === 'cookie') continue
     headers[key] = value
   }
   headers.host = `${UP_HOST}:${envConfig.relayPort}`
-  const upstream = https.connect({ host: UP_HOST, port: envConfig.relayPort, rejectUnauthorized: false }, () => {
+  const cookie = filterUpstreamCookies(req.headers.cookie)
+  if (cookie !== undefined) headers.cookie = cookie
+  // NOTE: https.connect does not exist in Node — the WS path used to crash
+  // with a TypeError on the first upgrade request. The tunnel is a plain
+  // TLS socket to the relay; tls.connect is the correct primitive, and the
+  // secureConnect callback is where the TOFU pin now runs (first byte).
+  const upstream = tls.connect({ host: UP_HOST, port: envConfig.relayPort, rejectUnauthorized: false }, () => {
+    const fp = typeof upstream.getPeerCertificate === 'function'
+      ? upstream.getPeerCertificate(true)?.fingerprint256
+      : undefined
+    try {
+      makeTlsPinChecker(envConfig.bmcTarget)?.(null, { fingerprint256: fp })
+    } catch (err) {
+      log?.warn?.(`[dsh-obmc-web] ${err.message}`)
+      socket.destroy()
+      upstream.destroy()
+      return
+    }
     const lines = [`${req.method} ${req.url} HTTP/1.1`]
     for (const [key, value] of Object.entries(headers)) lines.push(`${key}: ${value}`)
     upstream.write(lines.join('\r\n') + '\r\n\r\n')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iasiv5/dsh-obmc-web",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "OpenBMC 控制台入口：设置一级菜单「BMC 控制台」面板一键在顶层标签页打开 BMC Web UI，同源代理经 SSH 本地转发 relay（obmc-web-relay）抵达 BMC，BMC IP 变化自动探测并重定向隧道；需 SSH 跳板机可达 BMC。",
   "type": "module",
   "main": "./lib/index.js",