Merge pull request #231 from Hornwitser/auth-master

Port socket.io Authentication to master

CHANGELOG.md

@@ -1,15 +1,26 @@
+Changelog
+=========
+
 Version 2.0.0
-=============
+-------------
 
 - Fixed sslCert and sslPrivKey entries being ignored in the config.
 - Changed ssl key creation to be done at startup instead of on npm install.
 - Added error handling during master startup.
 
-Breaking Changes
-----------------
+### Breaking Changes
+
 - Node.js versions below 10 are no longer supported.
 - lib/authenticate no longer requires config to be passed to it.  Breaks
   playerManager.
 - The masterIP and masterPort config entries has been merged into masterURL.
   Breaks discordChat, playerManager, serverSelect, trainTeleports and
   clusterioModel.
+
+
+Version 1.2.1
+-------------
+
+### Breaking Changes
+
+- Added authentication to the socket.io server running on the master.

client.js

@@ -603,7 +603,10 @@ async function instanceManagement(instanceconfig) {
     console.log("Started instanceManagement();");
 
     /* Open websocket connection to master */
-	var socket = ioClient(config.masterURL);
+	var socket = ioClient(config.masterURL+"?token="+config.masterAuthToken);
+	socket.on("error", err => {
+		console.log("SOCKET | Error: ", err);
+	});
 	socket.on("hello", data => {
 		console.log("SOCKET | registering slave!");
 		socket.emit("registerSlave", {

master.js

@@ -756,6 +756,18 @@ class wsSlave {
 	}
 }
 
+io.use((socket, next) => {
+	let token = socket.handshake.query.token;
+	authenticate.check(token).then((result) => {
+		if (result.ok) {
+			next();
+		} else {
+			console.error(`SOCKET | authentication failed for ${socket.handshake.address}`);
+			next(new Error(result.msg));
+		}
+	});
+});
+
 io.on('connection', function (socket) {
 	// cleanup dead sockets from disconnected people
 	let terminatedConnections = 0;