From 44a0d55cd8e8eacbbe4dd42998e4ce5452b61da9 Mon Sep 17 00:00:00 2001 From: j4k0xb <55899582+j4k0xb@users.noreply.github.com> Date: Tue, 4 Feb 2025 05:50:28 +0100 Subject: [PATCH] add TLS certificate validation --- mods/bambu/certificates.js | 27 +++++++++++++++++++++++++++ mods/bambu/cli.js | 7 +++---- mods/bambu/frames.js | 4 +++- mods/bambu/init.js | 15 +++++++-------- mods/bambu/proxy.js | 7 +++++-- 5 files changed, 45 insertions(+), 15 deletions(-) create mode 100644 mods/bambu/certificates.js diff --git a/mods/bambu/certificates.js b/mods/bambu/certificates.js new file mode 100644 index 00000000..6a9e98b1 --- /dev/null +++ b/mods/bambu/certificates.js @@ -0,0 +1,27 @@ +/** + * Certificate authority (CA) for TLS communication with printers in LAN. + * Country: CN + * Organization: BBL Technologies Co., Ltd + * Common Name: BBL CA + */ +exports.bblCA = `-----BEGIN CERTIFICATE----- +MIIDZTCCAk2gAwIBAgIUV1FckwXElyek1onFnQ9kL7Bk4N8wDQYJKoZIhvcNAQEL +BQAwQjELMAkGA1UEBhMCQ04xIjAgBgNVBAoMGUJCTCBUZWNobm9sb2dpZXMgQ28u +LCBMdGQxDzANBgNVBAMMBkJCTCBDQTAeFw0yMjA0MDQwMzQyMTFaFw0zMjA0MDEw +MzQyMTFaMEIxCzAJBgNVBAYTAkNOMSIwIAYDVQQKDBlCQkwgVGVjaG5vbG9naWVz +IENvLiwgTHRkMQ8wDQYDVQQDDAZCQkwgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQDL3pnDdxGOk5Z6vugiT4dpM0ju+3Xatxz09UY7mbj4tkIdby4H +oeEdiYSZjc5LJngJuCHwtEbBJt1BriRdSVrF6M9D2UaBDyamEo0dxwSaVxZiDVWC +eeCPdELpFZdEhSNTaT4O7zgvcnFsfHMa/0vMAkvE7i0qp3mjEzYLfz60axcDoJLk +p7n6xKXI+cJbA4IlToFjpSldPmC+ynOo7YAOsXt7AYKY6Glz0BwUVzSJxU+/+VFy +/QrmYGNwlrQtdREHeRi0SNK32x1+bOndfJP0sojuIrDjKsdCLye5CSZIvqnbowwW +1jRwZgTBR29Zp2nzCoxJYcU9TSQp/4KZuWNVAgMBAAGjUzBRMB0GA1UdDgQWBBSP +NEJo3GdOj8QinsV8SeWr3US+HjAfBgNVHSMEGDAWgBSPNEJo3GdOj8QinsV8SeWr +3US+HjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQABlBIT5ZeG +fgcK1LOh1CN9sTzxMCLbtTPFF1NGGA13mApu6j1h5YELbSKcUqfXzMnVeAb06Htu +3CoCoe+wj7LONTFO++vBm2/if6Jt/DUw1CAEcNyqeh6ES0NX8LJRVSe0qdTxPJuA +BdOoo96iX89rRPoxeed1cpq5hZwbeka3+CJGV76itWp35Up5rmmUqrlyQOr/Wax6 +itosIzG0MfhgUzU51A2P/hSnD3NDMXv+wUY/AvqgIL7u7fbDKnku1GzEKIkfH8hm +Rs6d8SCU89xyrwzQ0PR853irHas3WrHVqab3P+qNwR0YirL0Qk7Xt/q3O1griNg2 +Blbjg3obpHo9 +-----END CERTIFICATE-----`; diff --git a/mods/bambu/cli.js b/mods/bambu/cli.js index d0d1d074..1fa50661 100644 --- a/mods/bambu/cli.js +++ b/mods/bambu/cli.js @@ -2,6 +2,7 @@ const [ host, pass, sn ] = process.argv.slice(2); const util = require('util'); const mqtt = require("mqtt"); const readline = require('readline'); +const { bblCA } = require("./certificates"); const reportTopic = `device/${sn}/report`; const requestTopic = `device/${sn}/request`; @@ -65,10 +66,8 @@ const options = { port: 8883, username: 'bblp', password: pass, - // ca: fs.readFileSync('ca.crt'), - // cert: fs.readFileSync('client.crt'), - // key: fs.readFileSync('client.key'), - rejectUnauthorized: false + ca: bblCA, + servername: sn }; function log() { diff --git a/mods/bambu/frames.js b/mods/bambu/frames.js index 7edbfa96..2b6c3800 100644 --- a/mods/bambu/frames.js +++ b/mods/bambu/frames.js @@ -5,6 +5,7 @@ const EventEmitter = require('events'); const tls = require('tls'); +const { bblCA } = require('./certificates'); class FrameStream extends EventEmitter { #remoteSocket; @@ -28,7 +29,8 @@ class FrameStream extends EventEmitter { const remoteSocket = this.#remoteSocket = tls.connect({ host, port: 6000, - rejectUnauthorized: false + ca: bblCA, + checkServerIdentity: () => {} // TODO: use `servername: serial` instead }, () => { // send authentication to start jpeg frame stream remoteSocket.write(Buffer.from(abuf)); diff --git a/mods/bambu/init.js b/mods/bambu/init.js index d8218402..399caa44 100644 --- a/mods/bambu/init.js +++ b/mods/bambu/init.js @@ -1,6 +1,7 @@ const { Client } = require('@gridspace/basic-ftp'); const { Readable } = require('stream'); const { FrameStream } = require('./frames'); +const { bblCA } = require('./certificates'); module.exports = async (server) => { @@ -24,15 +25,13 @@ module.exports = async (server) => { protocol: 'mqtts', port: 8883, username: 'bblp', - // ca: fs.readFileSync('ca.crt'), - // key: fs.readFileSync('client.key'), - // cert: fs.readFileSync('client.crt'), - rejectUnauthorized: false + ca: bblCA } constructor(host, code, serial, onready, onerror, onmessage) { this.#options.host = host; this.#options.password = code; + this.#options.servername = serial; this.#serial = serial; let client = this.#client = mqtt.connect(this.#options); @@ -152,7 +151,7 @@ module.exports = async (server) => { user, password, secure: "implicit", - secureOptions: { rejectUnauthorized: false } + secureOptions: { ca: bblCA, servername: args.serial } }); } catch (error) { util.log({ ftp_error: error }); @@ -312,7 +311,7 @@ module.exports = async (server) => { const data = req.app.post; const { host, code, filename, serial, ams, start } = query; const amsmap = ams ? ams.split(',').map(v => parseInt(v)) : undefined; - ftp_send({ host, code, filename, data }) + ftp_send({ host, code, filename, data, serial }) .then(() => { if (serial && start ==='true') { file_print({ host, code, serial, filename, amsmap }); @@ -363,7 +362,7 @@ module.exports = async (server) => { }); break; case "files": - ftp_list({ host, code }).then(files => { + ftp_list({ host, code, serial }).then(files => { debug && util.log({ ftp_files: files.length }); // console.log(JSON.stringify(files,undefined,4)); files = files @@ -384,7 +383,7 @@ module.exports = async (server) => { }); break; case "file-delete": - ftp_delete({ host, code, path }).then(() => { + ftp_delete({ host, code, path, serial }).then(() => { util.log({ ftp_delete: path }); wsend({ serial, deleted: path }); }); diff --git a/mods/bambu/proxy.js b/mods/bambu/proxy.js index ae93f954..331e9bb8 100644 --- a/mods/bambu/proxy.js +++ b/mods/bambu/proxy.js @@ -14,6 +14,7 @@ */ let util = require('util'); +const { bblCA } = require('./certificates'); let args = process.argv.slice(2); if (args.length !== 5) { @@ -130,7 +131,8 @@ const remoteMqttOptions = { username: 'bblp', password: code, protocol: 'mqtts', - rejectUnauthorized: false + ca: bblCA, + servername: serial }; // Start local MQTTS broker @@ -220,7 +222,8 @@ const camera = tls.createServer(options, (clientSocket) => { const remoteSocket = tls.connect({ host, port: 6000, - rejectUnauthorized: false + ca: bblCA, + servername: serial }, () => { // clientSocket.pipe(remoteSocket).pipe(clientSocket); });