Merge branch 'pr-328' into rel-4.1

add TLS cert validation per PR #328

mods/bambu/certificates.js

@@ -0,0 +1,27 @@
+/**
+ * Certificate authority (CA) for TLS communication with printers in LAN.
+ * Country: CN
+ * Organization: BBL Technologies Co., Ltd
+ * Common Name: BBL CA
+ */
+exports.bblCA = `-----BEGIN CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIUV1FckwXElyek1onFnQ9kL7Bk4N8wDQYJKoZIhvcNAQEL
+BQAwQjELMAkGA1UEBhMCQ04xIjAgBgNVBAoMGUJCTCBUZWNobm9sb2dpZXMgQ28u
+LCBMdGQxDzANBgNVBAMMBkJCTCBDQTAeFw0yMjA0MDQwMzQyMTFaFw0zMjA0MDEw
+MzQyMTFaMEIxCzAJBgNVBAYTAkNOMSIwIAYDVQQKDBlCQkwgVGVjaG5vbG9naWVz
+IENvLiwgTHRkMQ8wDQYDVQQDDAZCQkwgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDL3pnDdxGOk5Z6vugiT4dpM0ju+3Xatxz09UY7mbj4tkIdby4H
+oeEdiYSZjc5LJngJuCHwtEbBJt1BriRdSVrF6M9D2UaBDyamEo0dxwSaVxZiDVWC
+eeCPdELpFZdEhSNTaT4O7zgvcnFsfHMa/0vMAkvE7i0qp3mjEzYLfz60axcDoJLk
+p7n6xKXI+cJbA4IlToFjpSldPmC+ynOo7YAOsXt7AYKY6Glz0BwUVzSJxU+/+VFy
+/QrmYGNwlrQtdREHeRi0SNK32x1+bOndfJP0sojuIrDjKsdCLye5CSZIvqnbowwW
+1jRwZgTBR29Zp2nzCoxJYcU9TSQp/4KZuWNVAgMBAAGjUzBRMB0GA1UdDgQWBBSP
+NEJo3GdOj8QinsV8SeWr3US+HjAfBgNVHSMEGDAWgBSPNEJo3GdOj8QinsV8SeWr
+3US+HjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQABlBIT5ZeG
+fgcK1LOh1CN9sTzxMCLbtTPFF1NGGA13mApu6j1h5YELbSKcUqfXzMnVeAb06Htu
+3CoCoe+wj7LONTFO++vBm2/if6Jt/DUw1CAEcNyqeh6ES0NX8LJRVSe0qdTxPJuA
+BdOoo96iX89rRPoxeed1cpq5hZwbeka3+CJGV76itWp35Up5rmmUqrlyQOr/Wax6
+itosIzG0MfhgUzU51A2P/hSnD3NDMXv+wUY/AvqgIL7u7fbDKnku1GzEKIkfH8hm
+Rs6d8SCU89xyrwzQ0PR853irHas3WrHVqab3P+qNwR0YirL0Qk7Xt/q3O1griNg2
+Blbjg3obpHo9
+-----END CERTIFICATE-----`;

mods/bambu/cli.js

@@ -2,6 +2,7 @@ const [ host, pass, sn ] = process.argv.slice(2);
 const util = require('util');
 const mqtt = require("mqtt");
 const readline = require('readline');
+const { bblCA } = require("./certificates");
 const reportTopic = `device/${sn}/report`;
 const requestTopic = `device/${sn}/request`;
 
@@ -65,10 +66,8 @@ const options = {
     port: 8883,
     username: 'bblp',
     password: pass,
-    // ca: fs.readFileSync('ca.crt'),
+    ca: bblCA,
-    // cert: fs.readFileSync('client.crt'),
+    servername: sn
-    // key: fs.readFileSync('client.key'),
-    rejectUnauthorized: false
 };
 
 function log() {

mods/bambu/frames.js

@@ -5,6 +5,7 @@
 
 const EventEmitter = require('events');
 const tls = require('tls');
+const { bblCA } = require('./certificates');
 
 class FrameStream extends EventEmitter {
     #remoteSocket;
@@ -28,7 +29,8 @@ class FrameStream extends EventEmitter {
         const remoteSocket = this.#remoteSocket = tls.connect({
             host,
             port: 6000,
-            rejectUnauthorized: false
+            ca: bblCA,
+            checkServerIdentity: () => {} // TODO: use `servername: serial` instead
         }, () => {
             // send authentication to start jpeg frame stream
             remoteSocket.write(Buffer.from(abuf));

mods/bambu/init.js

@@ -1,6 +1,7 @@
 const { Client } = require('@gridspace/basic-ftp');
 const { Readable } = require('stream');
 const { FrameStream } = require('./frames');
+const { bblCA } = require('./certificates');
 
 module.exports = async (server) => {
 
@@ -24,15 +25,13 @@ module.exports = async (server) => {
             protocol: 'mqtts',
             port: 8883,
             username: 'bblp',
-            // ca: fs.readFileSync('ca.crt'),
+            ca: bblCA
-            // key: fs.readFileSync('client.key'),
-            // cert: fs.readFileSync('client.crt'),
-            rejectUnauthorized: false
         }
 
         constructor(host, code, serial, onready, onerror, onmessage) {
             this.#options.host = host;
             this.#options.password = code;
+            this.#options.servername = serial;
             this.#serial = serial;
             let client = this.#client = mqtt.connect(this.#options);
 
@@ -152,7 +151,7 @@ module.exports = async (server) => {
                 user,
                 password,
                 secure: "implicit",
-                secureOptions: { rejectUnauthorized: false }
+                secureOptions: { ca: bblCA, servername: args.serial }
             });
         } catch (error) {
             util.log({ ftp_error: error });
@@ -311,7 +310,7 @@ module.exports = async (server) => {
             res.setHeader('Cache-Control', 'no-cache, no-store, private');
             const data = req.app.post;
             const { host, code, filename, serial, ams, start } = query;
-            ftp_send({ host, code, filename, data })
+            ftp_send({ host, code, filename, data, serial })
                 .then(() => {
                     if (serial && start ==='true') {
                         file_print({ host, code, serial, filename, amsmap: ams });
@@ -362,7 +361,7 @@ module.exports = async (server) => {
                     });
                     break;
                 case "files":
-                    ftp_list({ host, code }).then(files => {
+                    ftp_list({ host, code, serial }).then(files => {
                         debug && util.log({ ftp_files: files.length });
                         // console.log(JSON.stringify(files,undefined,4));
                         files = files
@@ -383,7 +382,7 @@ module.exports = async (server) => {
                     });
                     break;
                 case "file-delete":
-                    ftp_delete({ host, code, path }).then(() => {
+                    ftp_delete({ host, code, path, serial }).then(() => {
                         util.log({ ftp_delete: path });
                         wsend({ serial, deleted: path });
                     });

mods/bambu/proxy.js

@@ -14,6 +14,7 @@
  */
 
 let util = require('util');
+const { bblCA } = require('./certificates');
 let args = process.argv.slice(2);
 
 if (args.length !== 5) {
@@ -130,7 +131,8 @@ const remoteMqttOptions = {
     username: 'bblp',
     password: code,
     protocol: 'mqtts',
-    rejectUnauthorized: false
+    ca: bblCA,
+    servername: serial
 };
 
 // Start local MQTTS broker
@@ -220,7 +222,8 @@ const camera = tls.createServer(options, (clientSocket) => {
     const remoteSocket = tls.connect({
         host,
         port: 6000,
-        rejectUnauthorized: false
+        ca: bblCA,
+        servername: serial
     }, () => {
         // clientSocket.pipe(remoteSocket).pipe(clientSocket);
     });