jens/docker-dosbox-novnc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Drop the iframe wrapper page and fix two real certificate bugs

Browse Source 
Video and audio no longer share one iframe-based /screen/<name> page.
Firefox refuses to load iframe content signed by a certificate whose
warning hasn't been accepted at the top level, with no way to click
through inside the iframe (Chrome is more lenient, which is why this
briefly looked fine there). "Open Screen" is now a plain top-level link
straight to noVNC's own URL (new tab, normal Accept-the-Risk applies),
and the "Enable Sound" toggle moved to the main setup page - meant to
be left open in its own tab while playing. Because that page now hosts
a persistent AudioContext/WebSocket, its auto-refresh no longer fires
just because a game is running (only during active installs), since a
full-page refresh would have killed that connection every 3s.

Two real certificate bugs found and fixed along the way:
- CN=NY (a meaningless placeholder) -> CN=localhost + SAN
  (DNS:localhost, IP:127.0.0.1). Firefox validates the WebSocket-Secure
  connection's cert against the hostname independently of the page
  load and rejected the CN mismatch there even after the page-level
  warning was accepted.
- Worse: adding -addext without also pinning basicConstraints=CA:FALSE
  left the cert defaulting to CA:TRUE - i.e. flagged as a Certificate
  Authority, not a server cert. Firefox hard-refuses that with no
  override option at all (not a normal clickable warning), which is
  why "the warning appears but won't let me proceed" even after the CN
  fix. Fixed by explicitly setting basicConstraints=critical,CA:FALSE
  plus keyUsage/extendedKeyUsage=serverAuth. Confirmed fixed: Firefox
  now shows the same clickable self-signed warning Chrome always did,
  and the noVNC connection completes successfully after accepting it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NiNnj78HGx1KWyCCo39HSz
This commit is contained in:
jens
2026-07-28 18:21:35 +02:00
co-authored by Claude Sonnet 5
parent 301503a276
commit eb63f46978
4 changed files with 73 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+12 -1
View File
@@ -20,7 +20,18 @@ RUN apt-get update && \
# every game's audio ends up mixed into Pulse's one default sink, captured by pcm_ws_bridge.py.
RUN printf 'pcm.!default pulse\nctl.!default pulse\n' > /etc/asound.conf
RUN openssl req -x509 -nodes -newkey rsa:2048 -keyout /tmp/novnc.key -out /tmp/novnc.pem -days 3650 -subj "/C=US/ST=NY/L=NY/O=NY/OU=NY/CN=NY emailAddress=email@example.com"
# CN/SAN set to localhost/127.0.0.1: some browsers (Firefox) validate the WebSocket-Secure
# connection's certificate against the hostname independently of the page load, and reject a
# CN mismatch there even after you've clicked through the warning for the HTML page itself.
# basicConstraints/keyUsage/extendedKeyUsage must be set explicitly to mark this as a leaf
# (end-entity) server cert - without them, openssl req -x509 defaults to CA:TRUE, which
# Firefox refuses outright (not a clickable warning, a hard block) for a TLS server cert.
RUN openssl req -x509 -nodes -newkey rsa:2048 -keyout /tmp/novnc.key -out /tmp/novnc.pem -days 3650 \
-subj "/C=US/ST=NY/L=NY/O=NY/OU=NY/CN=localhost" \
-addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
-addext "basicConstraints=critical,CA:FALSE" \
-addext "keyUsage=critical,digitalSignature,keyEncipherment" \
-addext "extendedKeyUsage=serverAuth"
RUN touch /root/.Xauthority
RUN mkdir -p ${GAMES_HOME}