Make challenger reset on deauth, add retrial stop point, remove cooki…

…e on reset, extend read deadline git challenge
NHAS · Nov 29, 2024 · ca3b1ee · ca3b1ee
1 parent afa44ae
commit ca3b1ee
Show file tree

Hide file tree

Showing 4 changed files with 25 additions and 5 deletions.
diff --git a/internal/mfaportal/resources/static/js/challenge.js b/internal/mfaportal/resources/static/js/challenge.js
@@ -3,18 +3,30 @@ const httpsEnabled = window.location.protocol == "https:";
 const url = (httpsEnabled ? 'wss://' : 'ws://') + window.location.host + "/challenge/";
 
 let backoff = 200;
+let attempts = 0;
 let challenge = localStorage.getItem("challenge");
-if (challenge === null || challenge === "null") {
+if (challenge === null || challenge === "null" || challenge == "") {
     // oidc sets the challenge via cookie
     challenge = getCookie("challenge");
-    if(challenge !== null) {
+    if(challenge !== null || challenge != "") {
         localStorage.setItem("challenge", challenge)
+    } else {
+        challenge = null
     }
     deleteCookie("challenge")
 }
 
+
+
 function connect() {
 
+    attempts++;
+
+    if(attempts > 5) {
+        console.log("giving up retrying websockets connection")
+        return
+    }
+
     let ws = new WebSocket(url);
     ws.onopen = function () {
         ws.send(
@@ -29,12 +41,14 @@ function connect() {
         let msg = JSON.parse(e.data)
         switch(msg) {
             case "challenge":
+                attempts = 0;
                 ws.send(
                     JSON.stringify({challenge: challenge
                 }));
             return
             case "reset":
                 localStorage.removeItem("challenge")
+                deleteCookie("challenge")
                 window.location.href = '/'
             return
         }

diff --git a/internal/router/firewall.go b/internal/router/firewall.go
@@ -291,7 +291,11 @@ func (f *Firewall) Deauthenticate(address string) error {
 		return fmt.Errorf("failed to parse address as netip.Addr: %s", err)
 	}
 
-	return f._deauthenticate(addr)
+	err = f._deauthenticate(addr)
+
+	f.challenger.Reset(address)
+
+	return err
 }
 
 func (f *Firewall) _deauthenticate(address netip.Addr) error {

diff --git a/internal/router/session_manager.go b/internal/router/session_manager.go
@@ -83,7 +83,7 @@ func (c *Challenger) Challenge(address string) error {
 		return fmt.Errorf("no connection found for device: %s", address)
 	}
 
-	err = conn.SetWriteDeadline(time.Now().Add(2 * time.Second))
+	err = conn.SetWriteDeadline(time.Now().Add(40 * time.Second))
 	if err != nil {
 		conn.Close()
 		return err
@@ -95,7 +95,7 @@ func (c *Challenger) Challenge(address string) error {
 		return err
 	}
 
-	err = conn.SetReadDeadline(time.Now().Add(2 * time.Second))
+	err = conn.SetReadDeadline(time.Now().Add(40 * time.Second))
 	if err != nil {
 		conn.Close()
 		return err

diff --git a/internal/router/statemachine.go b/internal/router/statemachine.go
@@ -137,6 +137,8 @@ func (f *Firewall) deviceChanges(_ string, current, previous data.Device, et dat
 				if err != nil {
 					return fmt.Errorf("cannot deauthenticate device %s: %s", current.Address, err)
 				}
+				// attempt to tell the device to reset on deauth
+
 			} else {
 				log.Printf("%s:%s device succeeded challenge", current.Username, current.Address)
 			}