termdock 1.4.296 → 1.4.297

package/dist/server/routes/computer.js

@@ -0,0 +1,198 @@
+import { Router } from 'express';
+import { isDeepStrictEqual } from 'node:util';
+import { hostname } from 'node:os';
+import { Socket } from 'node:net';
+import { resolveComputerHost } from './computerTarget.js';
+import { handleRdpWebSocket, rdpBackendAvailable, stopRdpBridges } from './rdp.js';
+import { computerLoginKey, computerPreferences } from '../shared/computerPreferences.js';
+import { loadSettings, updateSettings } from '../utils/settings.js';
+import { ComputerCredentialStore } from '../utils/computerCredentials.js';
+export function createComputerRouter(read = loadSettings, update = updateSettings, credentials = new ComputerCredentialStore()) {
+    const router = Router();
+    router.get('/status', async (_req, res) => res.json({ platform: process.platform, hostname: hostname(), rdpAvailable: await rdpBackendAvailable() }));
+    router.get('/preferences', (_req, res) => {
+        try {
+            const saved = read().computerControl;
+            const preferences = computerPreferences(saved, process.platform);
+            let credentialKeys = [], credentialError = false;
+            try {
+                credentialKeys = [preferences.local, preferences.remote].filter(profile => profile.rememberLogin && credentials.has(profile)).map(computerLoginKey);
+            }
+            catch {
+                credentialError = true;
+            }
+            res.set('Cache-Control', 'no-store').json({ preferences, configured: Boolean(saved), credentialKeys, credentialError });
+        }
+        catch {
+            res.status(500).json({ error: 'COMPUTER_PREFERENCES_READ_FAILED' });
+        }
+    });
+    // The full-service encrypted API boundary applies to every credential route.
+    router.post('/credentials/:action', (req, res) => {
+        res.set('Cache-Control', 'no-store');
+        try {
+            const { profile, password } = req.body ?? {};
+            const preferences = computerPreferences(read().computerControl, process.platform);
+            const matched = [preferences.local, preferences.remote].find(value => isDeepStrictEqual(value, profile));
+            const action = req.params.action;
+            const allowedKeys = action === 'save' ? ['profile', 'password'] : ['profile'];
+            if (!matched || !['save', 'use', 'forget'].includes(action) || Object.keys(req.body).some(key => !allowedKeys.includes(key))) {
+                res.status(400).json({ error: 'INVALID_COMPUTER_CREDENTIALS' });
+                return;
+            }
+            if (action === 'forget') {
+                credentials.forget(matched);
+                res.json({ saved: false });
+                return;
+            }
+            if (!matched.rememberLogin) {
+                res.status(400).json({ error: 'COMPUTER_LOGIN_NOT_REMEMBERED' });
+                return;
+            }
+            if (action === 'save') {
+                if (typeof password !== 'string' || !password || password.length > 1024 || password.includes('\0')) {
+                    res.status(400).json({ error: 'INVALID_COMPUTER_CREDENTIALS' });
+                    return;
+                }
+                credentials.save(matched, password);
+                res.json({ saved: true });
+                return;
+            }
+            const secret = credentials.get(matched);
+            if (!secret) {
+                res.status(404).json({ error: 'COMPUTER_CREDENTIALS_MISSING' });
+                return;
+            }
+            // Only the authenticated service page receives it, in memory, over Noise.
+            res.json({ password: secret });
+        }
+        catch {
+            res.status(500).json({ error: 'COMPUTER_CREDENTIALS_FAILED' });
+        }
+    });
+    router.put('/preferences', (req, res) => {
+        const preferences = computerPreferences(req.body, process.platform);
+        // Strict projection prevents credentials and unknown fields entering settings.
+        if (!req.body || !isDeepStrictEqual(preferences, req.body)) {
+            res.status(400).json({ error: 'INVALID_COMPUTER_PREFERENCES' });
+            return;
+        }
+        try {
+            update((settings) => { settings.computerControl = preferences; });
+            res.json({ preferences });
+        }
+        catch {
+            res.status(500).json({ error: 'COMPUTER_PREFERENCES_WRITE_FAILED' });
+        }
+    });
+    return router;
+}
+export default createComputerRouter();
+const bridges = new Set();
+export function stopComputerBridges() {
+    stopRdpBridges();
+    for (const bridge of bridges)
+        bridge.destroy();
+    bridges.clear();
+}
+/** RFB bytes are base64 records inside the existing authenticated Noise tunnel.
+ * The eight-record receive window applies TCP backpressure without dropping bytes. */
+export function handleComputerWebSocket(socket, host, options) {
+    if (options?.protocol === 'rdp') {
+        handleRdpWebSocket(socket, host, Number(options.port ?? 3389));
+        return;
+    }
+    if (options?.protocol && options.protocol !== 'vnc') {
+        socket.close(4400, 'COMPUTER_INVALID_PROTOCOL');
+        return;
+    }
+    let closed = false;
+    let tcp;
+    let sent = 0;
+    let acked = 0;
+    let lastAckAt = Date.now();
+    let connected = false;
+    const finish = (code = 1000, reason = '') => {
+        if (closed)
+            return;
+        closed = true;
+        clearTimeout(connectTimer);
+        clearInterval(flowTimer);
+        if (tcp) {
+            bridges.delete(tcp);
+            tcp.destroy();
+        }
+        socket.close(code, reason);
+    };
+    const connectTimer = setTimeout(() => finish(4408, 'COMPUTER_CONNECT_TIMEOUT'), 10_000);
+    const flowTimer = setInterval(() => {
+        if (sent > acked && Date.now() - lastAckAt > 30_000)
+            finish(4408, 'COMPUTER_STREAM_TIMEOUT');
+    }, 5000);
+    const pump = () => {
+        if (closed || !tcp)
+            return;
+        while (sent - acked < 8 && tcp.readableLength > 0) {
+            const bytes = tcp.read(Math.min(tcp.readableLength, 32 * 1024));
+            if (!bytes)
+                break;
+            if (sent === acked)
+                lastAckAt = Date.now();
+            socket.send(JSON.stringify({ type: 'data', seq: ++sent, data: bytes.toString('base64') }));
+            if (closed)
+                break;
+        }
+    };
+    socket.on('close', () => finish());
+    socket.on('error', () => finish());
+    socket.on('message', raw => {
+        if (closed)
+            return;
+        try {
+            const message = JSON.parse(raw.toString());
+            if (message.type === 'ack') {
+                if (!Number.isSafeInteger(message.seq) || message.seq <= acked || message.seq > sent)
+                    throw new Error('INVALID_ACK');
+                acked = message.seq;
+                lastAckAt = Date.now();
+                pump();
+            }
+            else if (message.type === 'data') {
+                if (!connected || !tcp || typeof message.data !== 'string' || message.data.length > 88_000
+                    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(message.data))
+                    throw new Error('INVALID_DATA');
+                const bytes = Buffer.from(message.data, 'base64');
+                if (!bytes.length || bytes.length > 64 * 1024 || tcp.writableLength + bytes.length > 1024 * 1024)
+                    throw new Error('INPUT_LIMIT');
+                tcp.write(bytes);
+            }
+            else
+                throw new Error('INVALID_MESSAGE');
+        }
+        catch {
+            finish(4400, 'COMPUTER_INVALID_MESSAGE');
+        }
+    });
+    void (async () => {
+        try {
+            const address = await resolveComputerHost(host);
+            if (closed)
+                return;
+            tcp = new Socket();
+            bridges.add(tcp);
+            tcp.setNoDelay(true);
+            tcp.on('readable', pump);
+            tcp.on('connect', () => { connected = true; clearTimeout(connectTimer); });
+            tcp.on('end', () => finish(1000, 'COMPUTER_DISCONNECTED'));
+            tcp.on('close', () => finish(1000, 'COMPUTER_DISCONNECTED'));
+            tcp.on('error', error => {
+                const code = error.code;
+                finish(4502, code === 'ECONNREFUSED' ? 'COMPUTER_SCREEN_SHARING_OFF' : 'COMPUTER_UNREACHABLE');
+            });
+            tcp.connect({ host: address.address, family: address.family, port: 5900 });
+        }
+        catch (reason) {
+            finish(4502, reason instanceof Error && /^COMPUTER_(?:INVALID_HOST|PRIVATE_HOST_ONLY)$/.test(reason.message) ? reason.message : 'COMPUTER_UNREACHABLE');
+        }
+    })();
+}

package/dist/server/routes/computerTarget.js

@@ -0,0 +1,23 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+export function privateComputerAddress(address) {
+    if (isIP(address) === 4) {
+        const [a, b] = address.split('.').map(Number);
+        return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
+    }
+    const value = address.toLowerCase();
+    if (value.startsWith('::ffff:'))
+        return privateComputerAddress(value.slice(7));
+    return isIP(value) === 6 && (value === '::1' || value.startsWith('fc') || value.startsWith('fd'));
+}
+/** Resolve once, reject mixed public/private DNS answers, and dial the pinned IP. */
+export async function resolveComputerHost(host) {
+    host = host.trim();
+    if (!host || host.length > 253 || (!isIP(host) && !/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/i.test(host))) {
+        throw new Error('COMPUTER_INVALID_HOST');
+    }
+    const addresses = await lookup(host, { all: true });
+    if (!addresses.length || addresses.some(item => !privateComputerAddress(item.address)))
+        throw new Error('COMPUTER_PRIVATE_HOST_ONLY');
+    return addresses[0];
+}

package/dist/server/routes/guacamoleProtocol.js

@@ -0,0 +1,55 @@
+export function guacamoleInstruction(...values) {
+    return values.map(value => `${Array.from(value).length}.${value}`).join(',') + ';';
+}
+/** Incremental UTF-8-decoded Guacamole parser. Lengths count Unicode code points. */
+export class GuacamoleParser {
+    instruction;
+    digits = '';
+    remaining = 0;
+    value = '';
+    values = [];
+    phase = 'length';
+    size = 0;
+    constructor(instruction) {
+        this.instruction = instruction;
+    }
+    receive(chunk) {
+        for (const char of chunk) {
+            if (++this.size > 2 * 1024 * 1024)
+                throw new Error('GUAC_INSTRUCTION_LIMIT');
+            if (this.phase === 'length') {
+                if (/^[0-9]$/.test(char) && this.digits.length < 7)
+                    this.digits += char;
+                else if (char === '.' && this.digits) {
+                    this.remaining = Number(this.digits);
+                    this.digits = '';
+                    if (this.remaining > 1024 * 1024)
+                        throw new Error('GUAC_ELEMENT_LIMIT');
+                    this.phase = this.remaining ? 'value' : 'separator';
+                }
+                else
+                    throw new Error('GUAC_INVALID_LENGTH');
+            }
+            else if (this.phase === 'value') {
+                this.value += char;
+                if (--this.remaining === 0)
+                    this.phase = 'separator';
+            }
+            else {
+                if (char !== ',' && char !== ';')
+                    throw new Error('GUAC_INVALID_SEPARATOR');
+                this.values.push(this.value);
+                this.value = '';
+                this.phase = 'length';
+                if (this.values.length > 256)
+                    throw new Error('GUAC_ARGUMENT_LIMIT');
+                if (char === ';') {
+                    const values = this.values;
+                    this.values = [];
+                    this.size = 0;
+                    this.instruction(values);
+                }
+            }
+        }
+    }
+}

package/dist/server/routes/rdp.js

@@ -0,0 +1,162 @@
+import { Socket } from 'node:net';
+import { StringDecoder } from 'node:string_decoder';
+import { resolveComputerHost } from './computerTarget.js';
+import { GuacamoleParser, guacamoleInstruction } from './guacamoleProtocol.js';
+const guacdPort = () => Number(process.env.TERMDOCK_GUACD_PORT) || 4822;
+const bridges = new Set();
+export function stopRdpBridges() { for (const tcp of bridges)
+    tcp.destroy(); bridges.clear(); }
+export function rdpBackendAvailable() {
+    return new Promise(resolve => {
+        const tcp = new Socket();
+        const done = (available) => { tcp.destroy(); resolve(available); };
+        tcp.setTimeout(500, () => done(false));
+        tcp.once('error', () => done(false));
+        tcp.once('connect', () => done(true));
+        tcp.connect(guacdPort(), '127.0.0.1');
+    });
+}
+/** Only this server builds guacd's handshake. Credentials arrive inside the
+ * authenticated encrypted logical socket, never query strings or logs. */
+export function handleRdpWebSocket(socket, host, port) {
+    let closed = false;
+    let started = false;
+    let ready = false;
+    let tcp;
+    let sent = 0;
+    let acked = 0;
+    let lastAckAt = Date.now();
+    let credentials = {};
+    const finish = (code = 1000, reason = '') => {
+        if (closed)
+            return;
+        closed = true;
+        credentials = {};
+        clearTimeout(timer);
+        clearInterval(flowTimer);
+        if (tcp) {
+            bridges.delete(tcp);
+            tcp.destroy();
+        }
+        socket.close(code, reason);
+    };
+    const timer = setTimeout(() => finish(4408, 'COMPUTER_CONNECT_TIMEOUT'), 15_000);
+    const flowTimer = setInterval(() => {
+        if (sent > acked && Date.now() - lastAckAt > 30_000)
+            finish(4408, 'COMPUTER_STREAM_TIMEOUT');
+    }, 5000);
+    const decoder = new StringDecoder('utf8');
+    let instructions = [];
+    let handshakeSent = false;
+    const parser = new GuacamoleParser(values => {
+        const [opcode, ...args] = values;
+        if (!ready && opcode === 'args' && !handshakeSent) {
+            handshakeSent = true;
+            tcp.write(guacamoleInstruction('size', credentials.width, credentials.height, '96')
+                + guacamoleInstruction('audio') + guacamoleInstruction('video')
+                + guacamoleInstruction('image', 'image/png', 'image/jpeg')
+                + guacamoleInstruction('connect', ...args.map(name => name.startsWith('VERSION_') ? 'VERSION_1_5_0' : credentials[name] ?? '')));
+            credentials = {};
+        }
+        else if (opcode === 'ready') {
+            if (!handshakeSent || ready)
+                throw new Error('GUAC_INVALID_HANDSHAKE');
+            ready = true;
+            clearTimeout(timer);
+            instructions.push(values);
+        }
+        else if (ready || opcode === 'error')
+            instructions.push(values);
+        else
+            throw new Error('GUAC_INVALID_HANDSHAKE');
+    });
+    const pump = () => {
+        if (closed || !tcp)
+            return;
+        try {
+            while (sent - acked < 8 && tcp.readableLength > 0) {
+                const bytes = tcp.read(Math.min(tcp.readableLength, 32 * 1024));
+                if (!bytes)
+                    break;
+                parser.receive(decoder.write(bytes));
+                if (instructions.length) {
+                    if (sent === acked)
+                        lastAckAt = Date.now();
+                    socket.send(JSON.stringify({ type: 'instructions', seq: ++sent, instructions }));
+                    instructions = [];
+                }
+            }
+        }
+        catch {
+            finish(4502, 'COMPUTER_INVALID_MESSAGE');
+        }
+    };
+    socket.on('close', () => finish());
+    socket.on('error', () => finish());
+    socket.on('message', raw => {
+        if (closed)
+            return;
+        try {
+            if (raw.toString().length > 128 * 1024)
+                throw new Error('INPUT_LIMIT');
+            const message = JSON.parse(raw.toString());
+            if (message.type === 'start' && !started) {
+                started = true;
+                for (const key of ['username', 'password', 'domain']) {
+                    if (typeof message[key] !== 'string' || message[key].length > 1024 || message[key].includes('\0'))
+                        throw new Error('INVALID_CREDENTIALS');
+                }
+                if (!message.username.trim() || !message.password || typeof message.ignoreCert !== 'boolean')
+                    throw new Error('INVALID_CREDENTIALS');
+                if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+                    throw new Error('INVALID_PORT');
+                credentials = {
+                    username: message.username, password: message.password, domain: message.domain,
+                    port: String(port), security: 'any', 'ignore-cert': String(message.ignoreCert),
+                    width: String(Math.max(640, Math.min(2560, Number(message.width) || 1280))),
+                    height: String(Math.max(480, Math.min(1600, Number(message.height) || 800))),
+                    'color-depth': '32', 'disable-audio': 'true', 'enable-drive': 'false',
+                    'disable-copy': 'true', 'server-layout': 'en-us-qwerty', 'resize-method': 'display-update',
+                };
+                void resolveComputerHost(host).then(address => {
+                    if (closed)
+                        return;
+                    credentials.hostname = address.address;
+                    tcp = new Socket();
+                    bridges.add(tcp);
+                    tcp.setNoDelay(true);
+                    tcp.on('readable', pump);
+                    tcp.once('connect', () => { tcp.write(guacamoleInstruction('select', 'rdp')); });
+                    tcp.once('error', () => finish(4503, 'COMPUTER_RDP_BACKEND_UNAVAILABLE'));
+                    tcp.once('end', () => finish(1000, 'COMPUTER_DISCONNECTED'));
+                    tcp.once('close', () => finish(1000, 'COMPUTER_DISCONNECTED'));
+                    tcp.connect(guacdPort(), '127.0.0.1');
+                }).catch(reason => finish(4400, reason instanceof Error && /^COMPUTER_(?:INVALID_HOST|PRIVATE_HOST_ONLY)$/.test(reason.message) ? reason.message : 'COMPUTER_UNREACHABLE'));
+            }
+            else if (message.type === 'ack') {
+                if (!Number.isSafeInteger(message.seq) || message.seq <= acked || message.seq > sent)
+                    throw new Error('INVALID_ACK');
+                acked = message.seq;
+                lastAckAt = Date.now();
+                pump();
+            }
+            else if (message.type === 'instruction' && ready && tcp) {
+                // Disallow re-handshakes, filesystem, recording, arbitrary connection
+                // parameters, and other protocols through this full-service bridge.
+                if (!['sync', 'key', 'mouse', 'clipboard', 'blob', 'end', 'ack', 'nop', 'size', 'disconnect'].includes(message.opcode)
+                    || !Array.isArray(message.args) || message.args.length > 8
+                    || message.args.some((arg) => typeof arg !== 'string' || arg.length > 64 * 1024)
+                    || tcp.writableLength > 1024 * 1024)
+                    throw new Error('INVALID_INSTRUCTION');
+                if (message.opcode === 'size' && (message.args.length !== 2 || message.args.some((value, index) => !/^\d{1,4}$/.test(value) || Number(value) < (index ? 480 : 640) || Number(value) > (index ? 1600 : 2560))))
+                    throw new Error('INVALID_SIZE');
+                tcp.write(guacamoleInstruction(message.opcode, ...message.args));
+            }
+            else
+                throw new Error('INVALID_MESSAGE');
+        }
+        catch {
+            finish(4400, 'COMPUTER_INVALID_MESSAGE');
+        }
+    });
+}