forked from gravitational/teleport
-
Notifications
You must be signed in to change notification settings - Fork 0
/
terminal.go
206 lines (183 loc) · 5.58 KB
/
terminal.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
/*
Copyright 2015 Gravitational, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package web
import (
"net/http"
"github.com/gravitational/teleport/lib/reversetunnel"
"github.com/gravitational/teleport/lib/services"
"github.com/gravitational/teleport/lib/session"
"github.com/gravitational/teleport/lib/sshutils"
"github.com/gravitational/teleport/lib/utils"
log "github.com/Sirupsen/logrus"
"github.com/gravitational/trace"
"golang.org/x/crypto/ssh"
"golang.org/x/net/websocket"
)
// terminalRequest describes a request to crate a web-based terminal
// to a remote SSH server
type terminalRequest struct {
// ServerID is a server id to connect to
ServerID string `json:"server_id"`
// User is linux username to connect as
Login string `json:"login"`
// Term sets PTY params like width and height
Term session.TerminalParams `json:"term"`
// SessionID is a teleport session ID to join as
SessionID session.ID `json:"sid"`
// Namespace is node namespace
Namespace string `json:"namespace"`
}
// newTerminal creates a web-based terminal based on WebSockets and returns a new
// terminalHandler
func newTerminal(req terminalRequest,
ctx *SessionContext,
site reversetunnel.RemoteSite) (*terminalHandler, error) {
clt, err := site.GetClient()
if err != nil {
return nil, trace.Wrap(err)
}
servers, err := clt.GetNodes(req.Namespace)
if err != nil {
return nil, trace.Wrap(err)
}
var server *services.Server
for i := range servers {
node := servers[i]
if node.GetName() == req.ServerID {
server = &node
}
}
if server == nil {
return nil, trace.NotFound("node '%v' not found", req.ServerID)
}
if req.Login == "" {
return nil, trace.BadParameter("login: missing login")
}
if req.Term.W <= 0 || req.Term.H <= 0 {
return nil, trace.BadParameter("term: bad term dimensions")
}
return &terminalHandler{
params: req,
ctx: ctx,
site: site,
server: *server,
}, nil
}
// terminalHandler connects together an SSH session with a web-based
// terminal via a web socket.
type terminalHandler struct {
// params describe the terminal configuration
params terminalRequest
// ctx is a web session context for the currently logged in user
ctx *SessionContext
ws *websocket.Conn
up *sshutils.Upstream
// site/cluster we're connected to
site reversetunnel.RemoteSite
// server we're connected to
server services.Server
}
func (w *terminalHandler) Close() error {
if w.ws != nil {
w.ws.Close()
}
if w.up != nil {
return w.up.Close()
}
return nil
}
// resizePTYWindow is called when a brower resizes its window. Now the node
// needs to be notified via SSH
func (w *terminalHandler) resizePTYWindow(params session.TerminalParams) error {
_, err := w.up.GetSession().SendRequest(
// send SSH "window resized" SSH request:
sshutils.WindowChangeReq, false,
ssh.Marshal(sshutils.WinChangeReqParams{
W: uint32(params.W),
H: uint32(params.H),
}))
return trace.Wrap(err)
}
// connectUpstream establishes the SSH connection to a requested SSH server (node)
func (t *terminalHandler) connectUpstream() (*sshutils.Upstream, error) {
agent, err := t.ctx.GetAgent()
if err != nil {
return nil, trace.Wrap(err)
}
defer agent.Close()
signers, err := agent.Signers()
if err != nil {
return nil, trace.Wrap(err)
}
client, err := t.site.ConnectToServer(
t.server.GetAddr(), t.params.Login, []ssh.AuthMethod{ssh.PublicKeys(signers...)})
if err != nil {
return nil, trace.Wrap(err)
}
up, err := sshutils.NewUpstream(client)
if err != nil {
return nil, trace.Wrap(err)
}
// this goroutine receives terminal window size changes in real time
// and stores the last size (example: "100:25") as a special "prefix"
// which gets added to future SSH reads by web clients.
go func() {
buff := make([]byte, 16)
sshChan, _, err := up.GetClient().OpenChannel("x-teleport-request-resize-events", nil)
for err == nil {
n, err := sshChan.Read(buff)
if err != nil {
break
}
up.SetPrefix(buff[:n])
}
if err != nil {
log.Error(err)
}
}()
up.GetSession().SendRequest(
sshutils.SetEnvReq, false,
ssh.Marshal(sshutils.EnvReqParams{
Name: sshutils.SessionEnvVar,
Value: string(t.params.SessionID),
}))
return up, nil
}
// Run creates a new websocket connection to the SSH server and runs
// the "loop" piping the input/output of the SSH session into the
// js-based terminal.
func (t *terminalHandler) Run(w http.ResponseWriter, r *http.Request) {
webSocketLoop := func(ws *websocket.Conn) {
up, err := t.connectUpstream()
if err != nil {
log.Error(err)
return
}
t.up = up
t.ws = ws
// PipeShell will be piping inputs/output to/from SSH connection (to the node)
// and the websocket (to a browser)
err = t.up.PipeShell(utils.NewWebSockWrapper(ws, utils.WebSocketTextMode),
&sshutils.PTYReqParams{
W: uint32(t.params.Term.W),
H: uint32(t.params.Term.H),
})
log.Infof("pipe shell finished with: %v", err)
}
// TODO(klizhentas)
// we instantiate a server explicitly here instead of using
// websocket.HandlerFunc to set empty origin checker
// make sure we check origin when in prod mode
ws := &websocket.Server{Handler: webSocketLoop}
ws.ServeHTTP(w, r)
}