bstansell / conserver

Logged, multi-user access to device consoles
https://www.conserver.com/
BSD 3-Clause "New" or "Revised" License
129 stars 38 forks source link

Clients started with console -s victim are promoted to writers in certain cases... #107

Closed beckerg closed 3 months ago

beckerg commented 3 months ago

1) If client 1 attaches in spy mode to a console, and subsequently client 2 attaches rw to the same console, then when client 2 disconnects client 1 remains in spy mode.

2) However, if client 1 attaches rw to a console, and subsequently client 2 attaches deliberately in spy mode to the same console (i.e., console -s victim), then when client 1 disconnects client 2 is promoted to write mode. These behaviors are inconsistent, surprising, and is potentially hazardous.

The problem is that in the second case (2) the "wantwr" flag is enabled for the spy mode client via a direct call to ClientWantsWrite(), which appears to be unnecessary, as the console client will analyze the messages returned from the server and issue the correct escape sequence to put the client into the desired mode.

For example, in case (2), if client 2 tries to attach rw then it will automatically be put into spy mode and the console client will issue/followup with an attach command. The attach will fail but will enable the "wantwr" bit such that when client 1 disconnects then client 2 will be correctly promoted to console writer.

I have a patch that fixes issue (2) for which I'll create an PR: https://github.com/bstansell/conserver/pull/108

bstansell commented 3 months ago

PR merged.