zydronium/rdpgw
1
0
Fork 0
mirror of https://github.com/bolkedebruin/rdpgw.git synced 2025-08-17 22:13:50 +02:00
Code Issues Projects Releases Packages Wiki Activity

Use encryption for cookies

Browse source
This commit is contained in:
Bolke de Bruin 2020-07-24 16:22:13 +02:00
parent 46e1e9b9f4
commit 5de3767e70
5 changed files with 27 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -42,9 +42,10 @@ server:
- any - any
# if true the server randomly selects a host to connect to # if true the server randomly selects a host to connect to
roundRobin: false roundRobin: false
# a random string of at least 32 characters to secure cookies on the client # a random strings of at least 32 characters to secure cookies on the client
# make sure to share this across the different pods # make sure to share this across the different pods
sessionKey: thisisasessionkeyreplacethisjetzt sessionKey: thisisasessionkeyreplacethisjetzt
sessionEncryptionKey: thisisasessionkeyreplacethisnunu!
# Open ID Connect specific settings # Open ID Connect specific settings
openId: openId:
providerUrl: http://keycloak/auth/realms/test providerUrl: http://keycloak/auth/realms/test

27
api/web.go
View file

@ -24,18 +24,19 @@ const (
type TokenGeneratorFunc func(string, string) (string, error) type TokenGeneratorFunc func(string, string) (string, error)
type Config struct { type Config struct {
SessionKey []byte SessionKey []byte
TokenGenerator TokenGeneratorFunc SessionEncryptionKey []byte
OAuth2Config *oauth2.Config TokenGenerator TokenGeneratorFunc
store *sessions.CookieStore OAuth2Config *oauth2.Config
TokenVerifier *oidc.IDTokenVerifier store *sessions.CookieStore
stateStore *cache.Cache TokenVerifier *oidc.IDTokenVerifier
Hosts []string stateStore *cache.Cache
GatewayAddress string Hosts []string
UsernameTemplate string GatewayAddress string
NetworkAutoDetect int UsernameTemplate string
BandwidthAutoDetect int NetworkAutoDetect int
ConnectionType int BandwidthAutoDetect int
ConnectionType int
} }
func (c *Config) NewApi() { func (c *Config) NewApi() {
@ -45,7 +46,7 @@ func (c *Config) NewApi() {
if len(c.Hosts) < 1 { if len(c.Hosts) < 1 {
log.Fatal("Not enough hosts to connect to specified") log.Fatal("Not enough hosts to connect to specified")
} }
c.store = sessions.NewCookieStore(c.SessionKey) c.store = sessions.NewCookieStore(c.SessionKey, c.SessionEncryptionKey)
c.stateStore = cache.New(time.Minute*2, 5*time.Minute) c.stateStore = cache.New(time.Minute*2, 5*time.Minute)
} }

17
config/configuration.go
View file

@ -10,17 +10,18 @@ type Configuration struct {
OpenId OpenIDConfig OpenId OpenIDConfig
Caps RDGCapsConfig Caps RDGCapsConfig
Security SecurityConfig Security SecurityConfig
Client ClientConfig Client ClientConfig
} }
type ServerConfig struct { type ServerConfig struct {
GatewayAddress string GatewayAddress string
Port int Port int
CertFile string CertFile string
KeyFile string KeyFile string
Hosts []string Hosts []string
RoundRobin bool RoundRobin bool
SessionKey string SessionKey string
SessionEncryptionKey string
} }
type OpenIDConfig struct { type OpenIDConfig struct {

1
main.go
View file

@ -61,6 +61,7 @@ func main() {
TokenVerifier: verifier, TokenVerifier: verifier,
TokenGenerator: security.GeneratePAAToken, TokenGenerator: security.GeneratePAAToken,
SessionKey: []byte(conf.Server.SessionKey), SessionKey: []byte(conf.Server.SessionKey),
SessionEncryptionKey: []byte(conf.Server.SessionEncryptionKey),
Hosts: conf.Server.Hosts, Hosts: conf.Server.Hosts,
NetworkAutoDetect: conf.Client.NetworkAutoDetect, NetworkAutoDetect: conf.Client.NetworkAutoDetect,
UsernameTemplate: conf.Client.UsernameTemplate, UsernameTemplate: conf.Client.UsernameTemplate,

3
protocol/handler.go
View file

@ -100,7 +100,7 @@ func (h *Handler) Process() error {
_, cookie := readCreateTunnelRequest(pkt) _, cookie := readCreateTunnelRequest(pkt)
if h.VerifyTunnelCreate != nil { if h.VerifyTunnelCreate != nil {
if ok, _ := h.VerifyTunnelCreate(h.Session, cookie); !ok { if ok, _ := h.VerifyTunnelCreate(h.Session, cookie); !ok {
log.Printf("Invalid PAA cookie: %s", cookie) log.Printf("Invalid PAA cookie received")
return errors.New("invalid PAA cookie") return errors.New("invalid PAA cookie")
} }
} }
@ -284,7 +284,6 @@ func readCreateTunnelRequest(data []byte) (caps uint32, cookie string) {
r.Read(cookieB) r.Read(cookieB)
cookie, _ = DecodeUTF16(cookieB) cookie, _ = DecodeUTF16(cookieB)
} }
log.Printf("Create tunnel caps: %d, cookie: %s", caps, cookie)
return return
} }