Switch built-in SSH server to github.com/gliderlabs/ssh

[belak]

This pull request is the first step towards making the built-in SSH server a good option. As discussed in discord, gliderlabs/ssh does a fairly good job at abstracting away most of the error-prone x/crypto/ssh code while still maintaining the flexibility we need.

A few things worth noting:

• The change in cmd/serv.go probably isn't needed (I can revert it if requested), but may be worthwhile anyway. I was using that before I was properly shell escaping command arguments.
• The copyright was changed from Gogs to Gitea because almost the entire file was rewritten, mostly from scratch.
• There's a TODO in Listen because gliderlabs/ssh doesn't currently support choosing ciphers, key exchanges, and MACs. I'd be happy to open a PR there to get that support in.
• It would be really nice if there was a way to use cmd/serv.go directly, rather than having to call it like this. That would allow us to avoid re-escaping command args as they come in.
• This now checks the incoming user against setting.SSH.BuiltinServerUser. I don't believe that was done before.

If anyone has a recommended test suite or things they'd like to see tested, please let me know and I will do my best.

[lunny]

CI failed.

[codecov-io]

Codecov Report

Merging #3896 into master will decrease coverage by 1.3%.
The diff coverage is 67.54%.

@@            Coverage Diff             @@
##           master    #3896      +/-   ##
==========================================
- Coverage   38.73%   37.42%   -1.31%     
==========================================
  Files         339      312      -27     
  Lines       49013    46323    -2690     
==========================================
- Hits        18983    17338    -1645     
+ Misses      27284    26509     -775     
+ Partials     2746     2476     -270

Impacted Files	Coverage Δ
modules/ssh/ssh.go	63.9% <67.54%> (+8.42%)	⬆️
routers/api/v1/org/org.go	0% <0%> (-42.39%)	⬇️
models/issue_mail.go	12% <0%> (-41.85%)	⬇️
modules/util/compare.go	12.12% <0%> (-33.34%)	⬇️
models/mail.go	1.73% <0%> (-22.4%)	⬇️
models/repo_mirror.go	2.62% <0%> (-21.65%)	⬇️
modules/notification/ui/ui.go	58.92% <0%> (-21.56%)	⬇️
modules/mailer/mailer.go	3.93% <0%> (-18.12%)	⬇️
models/update.go	31.65% <0%> (-17.59%)	⬇️
routers/repo/issue_stopwatch.go	26.66% <0%> (-15.44%)	⬇️
... and 134 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update baffea1...179f2ad. Read the comment docs.

[belak]

Sorry about that. Managed to figure out how to run drone locally and fixed the issues I saw - most notably, the BUILTIN_SSH_SERVER_USER option needs to be set and generated URLs use setting.SSH.BuiltinServerUser over setting.RunUser so there was a test which needed to be fixed.

[techknowlogick]

Please update to use dep

[belak]

I've been really busy lately but I still plan on updating this. I don't know if I can give a specific date though.

[belak]

This has been updated to use dep, though there were some oddities with the Godep.lock file which seems like it added something for all existing deps as well. Not sure how that should be handled.

[techknowlogick]

The lock file seems fine. Those additions are probably just from a newer version of dep.

[techknowlogick]

@belak any update?

[belak]

I'll get that change into gliderlabs/ssh which should let us have the same level of granularity with the internal algorithms (though I'm not 100% we need to expose that) and then fix up the Gopkg files. Is there anything else that needs to be done I'm missing?

[belak]

My apologies, I completely forgot about this. I'd be happy to clean this up some time this week.

[techknowlogick]

@belak no need to apologize, we appreciate your PR, and I'm the one who should be sorry as we should've done a better job of reviewing your PR sooner.

I'm just going through right now and doing some maintenance patches on older PRs so they aren't conflicted and make it easier for them to get reviewed, so I hope you don't mind that I pushed directly to your branch.

[techknowlogick]

@belak I've just created #7250 which resolves the conflicts from this PR. I am going to close this PR, let me know if you want access to the other PR if you want to make any changes to it. Thank you for the work you did for this PR :)