/
control.go
325 lines (271 loc) · 8.24 KB
/
control.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
// Copyright 2022 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package tssh
import (
"bytes"
"encoding/binary"
"fmt"
"io"
"net"
"sync"
_ "unsafe"
"golang.org/x/crypto/ssh"
)
//go:linkname newMux golang.org/x/crypto/ssh.newMux
func newMux(p packetConn) *mux
//go:linkname muxSendRequest golang.org/x/crypto/ssh.(*mux).SendRequest
func muxSendRequest(m *mux, name string, wantReply bool, payload []byte) (bool, []byte, error)
//go:linkname muxOpenChannel golang.org/x/crypto/ssh.(*mux).OpenChannel
func muxOpenChannel(m *mux, chanType string, extra []byte) (ssh.Channel, <-chan *ssh.Request, error)
//go:linkname muxWait golang.org/x/crypto/ssh.(*mux).Wait
func muxWait(m *mux) error
// packetConn represents a transport that implements packet based
// operations.
type packetConn interface {
// Encrypt and send a packet of data to the remote peer.
writePacket(packet []byte) error
// Read a packet from the connection. The read is blocking,
// i.e. if error is nil, then the returned byte slice is
// always non-empty.
readPacket() ([]byte, error)
// Close closes the write-side of the connection.
Close() error
}
// channel is an implementation of the Channel interface that works
// with the mux class.
type channel struct{} // nolint:all
// chanList is a thread safe channel list.
type chanList struct { // nolint:all
// protects concurrent access to chans
sync.Mutex
// chans are indexed by the local id of the channel, which the
// other side should send in the PeersId field.
chans []*channel
// This is a debugging aid: it offsets all IDs by this
// amount. This helps distinguish otherwise identical
// server/client muxes
offset uint32
}
// mux represents the state for the SSH connection protocol, which
// multiplexes many channels onto a single packet transport.
type mux struct {
conn packetConn // nolint:all
chanList chanList // nolint:all
incomingChannels chan ssh.NewChannel
globalSentMu sync.Mutex // nolint:all
globalResponses chan interface{} // nolint:all
incomingRequests chan *ssh.Request
errCond *sync.Cond // nolint:all
err error // nolint:all
}
type connTransport interface {
packetConn
getSessionID() []byte
waitSession() error
}
// A connection represents an incoming connection.
type connection struct {
transport connTransport
sshConn
// The connection protocol.
*mux
}
func (c *connection) Close() error {
return c.sshConn.conn.Close()
}
func (c *connection) SendRequest(name string, wantReply bool, payload []byte) (bool, []byte, error) {
return muxSendRequest(c.mux, name, wantReply, payload)
}
func (c *connection) OpenChannel(chanType string, extra []byte) (ssh.Channel, <-chan *ssh.Request, error) {
return muxOpenChannel(c.mux, chanType, extra)
}
func (c *connection) Wait() error {
return muxWait(c.mux)
}
// sshConn provides net.Conn metadata, but disallows direct reads and
// writes.
type sshConn struct {
conn net.Conn
user string
sessionID []byte
clientVersion []byte
serverVersion []byte
}
func dup(src []byte) []byte {
dst := make([]byte, len(src))
copy(dst, src)
return dst
}
func (c *sshConn) User() string {
return c.user
}
func (c *sshConn) RemoteAddr() net.Addr {
return c.conn.RemoteAddr()
}
func (c *sshConn) Close() error {
return c.conn.Close()
}
func (c *sshConn) LocalAddr() net.Addr {
return c.conn.LocalAddr()
}
func (c *sshConn) SessionID() []byte {
return dup(c.sessionID)
}
func (c *sshConn) ClientVersion() []byte {
return dup(c.clientVersion)
}
func (c *sshConn) ServerVersion() []byte {
return dup(c.serverVersion)
}
// NewControlClientConn establishes an SSH connection over an OpenSSH
// ControlMaster socket c in proxy mode. The Request and NewChannel channels
// must be serviced or the connection will hang.
func NewControlClientConn(c net.Conn) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
conn := &connection{
sshConn: sshConn{conn: c},
}
var err error
if conn.transport, err = handshakeControlProxy(c); err != nil {
return nil, nil, nil, fmt.Errorf("ssh: control proxy handshake failed; %v", err)
}
conn.mux = newMux(conn.transport)
return conn, conn.mux.incomingChannels, conn.mux.incomingRequests, nil
}
const (
muxMsgHello = 0x00000001
muxCliProxy = 0x1000000f
muxSvrProxy = 0x8000000f
muxSFailure = 0x80000003
)
// handshakeControlProxy attempts to establish a transport connection with an
// OpenSSH ControlMaster socket in proxy mode. For details see:
// https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.mux
func handshakeControlProxy(rw io.ReadWriteCloser) (connTransport, error) {
b := &controlBuffer{}
b.writeUint32(muxMsgHello)
b.writeUint32(4) // Protocol Version
if _, err := rw.Write(b.lengthPrefixedBytes()); err != nil {
return nil, fmt.Errorf("mux hello write failed: %v", err)
}
b.Reset()
b.writeUint32(muxCliProxy)
b.writeUint32(0) // Request ID
if _, err := rw.Write(b.lengthPrefixedBytes()); err != nil {
return nil, fmt.Errorf("mux client proxy write failed: %v", err)
}
r := controlReader{rw}
m, err := r.next()
if err != nil {
return nil, fmt.Errorf("mux hello read failed: %v", err)
}
if m.messageType != muxMsgHello {
return nil, fmt.Errorf("mux reply not hello")
}
if v, err := m.readUint32(); err != nil || v != 4 {
return nil, fmt.Errorf("mux reply hello has bad protocol version")
}
m, err = r.next()
if err != nil {
return nil, fmt.Errorf("error reading mux server proxy: %v", err)
}
if m.messageType != muxSvrProxy {
return nil, fmt.Errorf("expected server proxy response got %d", m.messageType)
}
return &controlProxyTransport{rw}, nil
}
// controlProxyTransport implements the connTransport interface for
// ControlMaster connections. Each controlMessage has zero length padding and
// no MAC.
type controlProxyTransport struct {
rw io.ReadWriteCloser
}
func (p *controlProxyTransport) Close() error {
return p.rw.Close()
}
func (p *controlProxyTransport) getSessionID() []byte {
return nil
}
func (p *controlProxyTransport) readPacket() ([]byte, error) {
var l uint32
err := binary.Read(p.rw, binary.BigEndian, &l)
if err == nil {
buf := &bytes.Buffer{}
_, err = io.CopyN(buf, p.rw, int64(l))
if err == nil {
// Discard the padding byte.
_, _ = buf.ReadByte()
return buf.Bytes(), nil
}
}
return nil, err
}
func (p *controlProxyTransport) writePacket(controlMessage []byte) error {
l := uint32(len(controlMessage)) + 1
b := &bytes.Buffer{}
_ = binary.Write(b, binary.BigEndian, &l) // controlMessage Length.
b.WriteByte(0) // Padding Length.
b.Write(controlMessage)
_, err := p.rw.Write(b.Bytes())
return err
}
func (p *controlProxyTransport) waitSession() error {
return nil
}
type controlBuffer struct {
bytes.Buffer
}
func (b *controlBuffer) writeUint32(i uint32) {
_ = binary.Write(b, binary.BigEndian, i)
}
func (b *controlBuffer) lengthPrefixedBytes() []byte {
b2 := &bytes.Buffer{}
_ = binary.Write(b2, binary.BigEndian, uint32(b.Len()))
b2.Write(b.Bytes())
return b2.Bytes()
}
type controlMessage struct {
body bytes.Buffer
messageType uint32
}
func (p controlMessage) readUint32() (uint32, error) {
var u uint32
err := binary.Read(&p.body, binary.BigEndian, &u)
return u, err
}
func (p controlMessage) readString() (string, error) {
var l uint32
err := binary.Read(&p.body, binary.BigEndian, &l)
if err != nil {
return "", fmt.Errorf("error reading string length: %v", err)
}
b := p.body.Next(int(l))
if len(b) != int(l) {
return string(b), fmt.Errorf("EOF on string read")
}
return string(b), nil
}
type controlReader struct {
r io.Reader
}
func (r controlReader) next() (*controlMessage, error) {
p := &controlMessage{}
var len uint32
err := binary.Read(r.r, binary.BigEndian, &len)
if err != nil {
return nil, fmt.Errorf("error reading message length: %v", err)
}
_, err = io.CopyN(&p.body, r.r, int64(len))
if err != nil {
return nil, fmt.Errorf("error reading message payload: %v", err)
}
err = binary.Read(&p.body, binary.BigEndian, &p.messageType)
if err != nil {
return nil, fmt.Errorf("error reading message type: %v", err)
}
if p.messageType == muxSFailure {
reason, _ := p.readString()
return nil, fmt.Errorf("server failure: '%s'", reason)
}
return p, nil
}