|
|
|
|
@ -1,20 +1,15 @@
|
|
|
|
|
package obfssh
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
|
"encoding/binary"
|
|
|
|
|
"fmt"
|
|
|
|
|
"io"
|
|
|
|
|
"io/ioutil"
|
|
|
|
|
"net"
|
|
|
|
|
"os"
|
|
|
|
|
"os/exec"
|
|
|
|
|
"os/user"
|
|
|
|
|
"runtime"
|
|
|
|
|
"syscall"
|
|
|
|
|
"time"
|
|
|
|
|
|
|
|
|
|
"github.com/containerd/console"
|
|
|
|
|
"github.com/fangdingjun/go-log/v5"
|
|
|
|
|
"github.com/fangdingjun/go-log"
|
|
|
|
|
"github.com/pkg/sftp"
|
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
|
)
|
|
|
|
|
@ -34,6 +29,8 @@ type Server struct {
|
|
|
|
|
// config is &ssh.ServerConfig
|
|
|
|
|
//
|
|
|
|
|
// conf is the server configure
|
|
|
|
|
//
|
|
|
|
|
//
|
|
|
|
|
func NewServer(c net.Conn, config *ssh.ServerConfig, conf *Conf) (*Server, error) {
|
|
|
|
|
sshConn, ch, req, err := ssh.NewServerConn(&TimedOutConn{c, 15 * 60 * time.Second}, config)
|
|
|
|
|
if err != nil {
|
|
|
|
|
@ -149,252 +146,78 @@ type exitStatus struct {
|
|
|
|
|
Status uint32
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
type ptyReq struct {
|
|
|
|
|
Term string
|
|
|
|
|
Columns uint32
|
|
|
|
|
Rows uint32
|
|
|
|
|
Width uint32
|
|
|
|
|
Height uint32
|
|
|
|
|
Mode string
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
type windowChange struct {
|
|
|
|
|
Columns uint32
|
|
|
|
|
Rows uint32
|
|
|
|
|
Width uint32
|
|
|
|
|
Height uint32
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func parseTerminalModes(s string) ssh.TerminalModes {
|
|
|
|
|
// log.Debugf("%x", s)
|
|
|
|
|
s1 := []byte(s)
|
|
|
|
|
t := ssh.TerminalModes{}
|
|
|
|
|
for i := 0; i < len(s1); i += 5 {
|
|
|
|
|
k := uint8(s1[i])
|
|
|
|
|
if k == 0 {
|
|
|
|
|
break
|
|
|
|
|
}
|
|
|
|
|
v := binary.BigEndian.Uint32(s1[i+1 : i+5])
|
|
|
|
|
t[k] = v
|
|
|
|
|
// log.Debugf("k %d, v %d", k, v)
|
|
|
|
|
}
|
|
|
|
|
return t
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
type session struct {
|
|
|
|
|
ch ssh.Channel
|
|
|
|
|
env []string
|
|
|
|
|
_console console.Console
|
|
|
|
|
ptsname string
|
|
|
|
|
cmd *exec.Cmd
|
|
|
|
|
user string
|
|
|
|
|
func (sc *Server) handleSession(newch ssh.NewChannel) {
|
|
|
|
|
ch, req, err := newch.Accept()
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorf("%s", err.Error())
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *session) handleSubsystem(payload []byte) bool {
|
|
|
|
|
var _cmd args
|
|
|
|
|
if err := ssh.Unmarshal(payload, &_cmd); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if _cmd.Arg != "sftp" { // only support sftp
|
|
|
|
|
ret := false
|
|
|
|
|
var cmd *exec.Cmd
|
|
|
|
|
var env []string
|
|
|
|
|
|
|
|
|
|
for r := range req {
|
|
|
|
|
switch r.Type {
|
|
|
|
|
case "subsystem":
|
|
|
|
|
if err := ssh.Unmarshal(r.Payload, &_cmd); err == nil {
|
|
|
|
|
if _cmd.Arg == "sftp" { // only support sftp
|
|
|
|
|
ret = true
|
|
|
|
|
log.Debugf("handle sftp request")
|
|
|
|
|
go serveSFTP(ch)
|
|
|
|
|
} else {
|
|
|
|
|
log.Debugln("subsystem", _cmd.Arg, "not support")
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
log.Debugf("handle sftp request")
|
|
|
|
|
go serveSFTP(s.ch)
|
|
|
|
|
return true
|
|
|
|
|
} else {
|
|
|
|
|
ret = false
|
|
|
|
|
log.Debugln("get subsystem arg error", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *session) handleShell() bool {
|
|
|
|
|
var cmd *exec.Cmd
|
|
|
|
|
case "shell":
|
|
|
|
|
ret = true
|
|
|
|
|
if runtime.GOOS == "windows" {
|
|
|
|
|
s.env = append(s.env, "SHELL=powershell")
|
|
|
|
|
cmd = exec.Command("powershell")
|
|
|
|
|
} else {
|
|
|
|
|
s.env = append(s.env, "SHELL=/bin/bash")
|
|
|
|
|
cmd = exec.Command("/bin/bash", "-l")
|
|
|
|
|
}
|
|
|
|
|
s.cmd = cmd
|
|
|
|
|
cmd.Env = s.env
|
|
|
|
|
go handleShell(cmd, s.ch, s._console, s.ptsname, s.user)
|
|
|
|
|
return true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *session) handleExec(payload []byte) bool {
|
|
|
|
|
var _cmd args
|
|
|
|
|
var cmd *exec.Cmd
|
|
|
|
|
if err := ssh.Unmarshal(payload, &_cmd); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
cmd = exec.Command("bash", "-l")
|
|
|
|
|
}
|
|
|
|
|
cmd.Env = env
|
|
|
|
|
go handleShell(cmd, ch)
|
|
|
|
|
case "signal":
|
|
|
|
|
log.Debugln("got signal")
|
|
|
|
|
ret = true
|
|
|
|
|
case "exec":
|
|
|
|
|
ret = true
|
|
|
|
|
if err = ssh.Unmarshal(r.Payload, &_cmd); err == nil {
|
|
|
|
|
log.Infoln("execute command", _cmd.Arg)
|
|
|
|
|
if runtime.GOOS == "windows" {
|
|
|
|
|
s.env = append(s.env, "SHELL=powershell")
|
|
|
|
|
cmd = exec.Command("powershell", "-Command", _cmd.Arg)
|
|
|
|
|
} else {
|
|
|
|
|
s.env = append(s.env, "SHELL=/bin/bash")
|
|
|
|
|
cmd = exec.Command("/bin/bash", "-c", _cmd.Arg)
|
|
|
|
|
cmd = exec.Command("bash", "-c", _cmd.Arg)
|
|
|
|
|
}
|
|
|
|
|
s.cmd = cmd
|
|
|
|
|
cmd.Env = s.env
|
|
|
|
|
go handleShell(cmd, s.ch, s._console, s.ptsname, s.user)
|
|
|
|
|
return true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *session) handlePtyReq(payload []byte) bool {
|
|
|
|
|
var _ptyReq ptyReq
|
|
|
|
|
var err error
|
|
|
|
|
if err = ssh.Unmarshal(payload, &_ptyReq); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log.Debugf("pty req Rows: %d, Columns: %d, Mode: %x", _ptyReq.Rows, _ptyReq.Columns, _ptyReq.Mode)
|
|
|
|
|
|
|
|
|
|
termios := parseTerminalModes(_ptyReq.Mode)
|
|
|
|
|
log.Debugf("parsed terminal mode %+v", termios)
|
|
|
|
|
|
|
|
|
|
s._console, s.ptsname, err = newPty()
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log.Debugf("allocate pty %s", s.ptsname)
|
|
|
|
|
log.Debugf("set termios")
|
|
|
|
|
if err1 := setTermios(int(s._console.Fd()), termios); err1 != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
s.env = append(s.env, fmt.Sprintf("SSH_TTY=%s", s.ptsname))
|
|
|
|
|
s.env = append(s.env, fmt.Sprintf("TERM=%s", _ptyReq.Term))
|
|
|
|
|
|
|
|
|
|
ws, _ := s._console.Size()
|
|
|
|
|
log.Debugf("current console %+v", ws)
|
|
|
|
|
ws.Height = uint16(_ptyReq.Rows)
|
|
|
|
|
ws.Width = uint16(_ptyReq.Columns)
|
|
|
|
|
if err = s._console.Resize(ws); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
return true
|
|
|
|
|
cmd.Env = env
|
|
|
|
|
//cmd.Stdin = ch
|
|
|
|
|
go handleCommand(cmd, ch)
|
|
|
|
|
} else {
|
|
|
|
|
log.Debugln(err)
|
|
|
|
|
ret = false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *session) handleEnv(payload []byte) bool {
|
|
|
|
|
case "pty-req":
|
|
|
|
|
ret = true
|
|
|
|
|
case "env":
|
|
|
|
|
var arg envArgs
|
|
|
|
|
if err := ssh.Unmarshal(payload, &arg); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
ret = true
|
|
|
|
|
if err = ssh.Unmarshal(r.Payload, &arg); err == nil {
|
|
|
|
|
log.Debugf("got env %s=%s", arg.Name, arg.Value)
|
|
|
|
|
s.env = append(s.env, fmt.Sprintf("%s=%s", arg.Name, arg.Value))
|
|
|
|
|
return true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *session) handleWindowChange(payload []byte) bool {
|
|
|
|
|
var _windowChange windowChange
|
|
|
|
|
if err := ssh.Unmarshal(payload, &_windowChange); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
log.Debugf("window change %+v", _windowChange)
|
|
|
|
|
if s._console == nil {
|
|
|
|
|
// ignore
|
|
|
|
|
return true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ws, err := s._console.Size()
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log.Debugf("current console %+v", ws)
|
|
|
|
|
ws.Height = uint16(_windowChange.Rows)
|
|
|
|
|
ws.Width = uint16(_windowChange.Columns)
|
|
|
|
|
if err := s._console.Resize(ws); err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
return true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (sc *Server) handleAuthAgentForward(sess *session) bool {
|
|
|
|
|
f, err := ioutil.TempFile("", "agent-")
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
p := f.Name()
|
|
|
|
|
f.Close()
|
|
|
|
|
os.Remove(p)
|
|
|
|
|
|
|
|
|
|
l, err := net.Listen("unix", p)
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sess.env = append(sess.env, fmt.Sprintf("SSH_AUTH_SOCK=%s", p))
|
|
|
|
|
|
|
|
|
|
sc.forwardedPorts[p] = l
|
|
|
|
|
|
|
|
|
|
go func() {
|
|
|
|
|
defer os.Remove(p)
|
|
|
|
|
for {
|
|
|
|
|
c, err := l.Accept()
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
break
|
|
|
|
|
}
|
|
|
|
|
go func(c net.Conn) {
|
|
|
|
|
ch, req, err := sc.sshConn.OpenChannel("auth-agent@openssh.com", nil)
|
|
|
|
|
if err != nil {
|
|
|
|
|
c.Close()
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
go ssh.DiscardRequests(req)
|
|
|
|
|
PipeAndClose(ch, c)
|
|
|
|
|
}(c)
|
|
|
|
|
}
|
|
|
|
|
}()
|
|
|
|
|
return true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (sc *Server) handleSession(newch ssh.NewChannel) {
|
|
|
|
|
ch, req, err := newch.Accept()
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorf("%s", err.Error())
|
|
|
|
|
return
|
|
|
|
|
env = append(env, fmt.Sprintf("%s=%s", arg.Name, arg.Value))
|
|
|
|
|
} else {
|
|
|
|
|
log.Debugln("parse env failed", err)
|
|
|
|
|
ret = false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sess := &session{ch: ch, user: sc.sshConn.User()}
|
|
|
|
|
|
|
|
|
|
for r := range req {
|
|
|
|
|
ret := false
|
|
|
|
|
switch r.Type {
|
|
|
|
|
case "subsystem":
|
|
|
|
|
ret = sess.handleSubsystem(r.Payload)
|
|
|
|
|
case "shell":
|
|
|
|
|
ret = sess.handleShell()
|
|
|
|
|
case "exec":
|
|
|
|
|
ret = sess.handleExec(r.Payload)
|
|
|
|
|
case "pty-req":
|
|
|
|
|
ret = sess.handlePtyReq(r.Payload)
|
|
|
|
|
case "env":
|
|
|
|
|
ret = sess.handleEnv(r.Payload)
|
|
|
|
|
case "window-change":
|
|
|
|
|
ret = sess.handleWindowChange(r.Payload)
|
|
|
|
|
case "auth-agent-req@openssh.com":
|
|
|
|
|
ret = sc.handleAuthAgentForward(sess)
|
|
|
|
|
case "signal":
|
|
|
|
|
log.Debugln("got signal")
|
|
|
|
|
ret = true
|
|
|
|
|
default:
|
|
|
|
|
ret = false
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log.Debugf("session request %s, reply %v", r.Type, ret)
|
|
|
|
|
@ -403,63 +226,34 @@ func (sc *Server) handleSession(newch ssh.NewChannel) {
|
|
|
|
|
r.Reply(ret, nil)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if sess.cmd != nil && sess.cmd.Process != nil {
|
|
|
|
|
log.Debugf("kill the running process %s", sess.cmd.Args)
|
|
|
|
|
p := sess.cmd.Process
|
|
|
|
|
if err := p.Kill(); err != nil {
|
|
|
|
|
log.Debugln(err)
|
|
|
|
|
}
|
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
|
if err := p.Signal(os.Kill); err != nil {
|
|
|
|
|
log.Debugln(err)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log.Debugln("session ended.")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func handleShell(cmd *exec.Cmd, ch ssh.Channel, _console console.Console, ptsname string, _user string) {
|
|
|
|
|
defer func() {
|
|
|
|
|
ch.Close()
|
|
|
|
|
if _console != nil {
|
|
|
|
|
_console.Close()
|
|
|
|
|
}
|
|
|
|
|
}()
|
|
|
|
|
func handleShell(cmd *exec.Cmd, ch ssh.Channel) {
|
|
|
|
|
defer ch.Close()
|
|
|
|
|
|
|
|
|
|
var _pty io.ReadWriteCloser
|
|
|
|
|
var err error
|
|
|
|
|
|
|
|
|
|
if cmd.SysProcAttr == nil {
|
|
|
|
|
cmd.SysProcAttr = &syscall.SysProcAttr{}
|
|
|
|
|
}
|
|
|
|
|
log.Infoln("start shell")
|
|
|
|
|
|
|
|
|
|
_u, err := user.Lookup(_user)
|
|
|
|
|
//_pty, err = pty.Start(cmd)
|
|
|
|
|
if runtime.GOOS == "unix" || runtime.GOOS == "linux" {
|
|
|
|
|
_pty, err = startPty(cmd)
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
setUserEnv(cmd, _u, cmd.SysProcAttr)
|
|
|
|
|
|
|
|
|
|
if _console != nil {
|
|
|
|
|
_tty, err := os.OpenFile(ptsname, syscall.O_RDWR|syscall.O_NOCTTY, 0600)
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Errorln(err)
|
|
|
|
|
log.Debugln("start pty", err)
|
|
|
|
|
ch.SendRequest("exit-status", false,
|
|
|
|
|
ssh.Marshal(exitStatus{Status: 127}))
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
defer _tty.Close()
|
|
|
|
|
cmd.Stderr = _tty
|
|
|
|
|
cmd.Stdout = _tty
|
|
|
|
|
cmd.Stdin = _tty
|
|
|
|
|
|
|
|
|
|
setProcAttr(cmd.SysProcAttr)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
go io.Copy(ch, _console)
|
|
|
|
|
go io.Copy(_console, ch)
|
|
|
|
|
} else {
|
|
|
|
|
if runtime.GOOS == "unix" || runtime.GOOS == "linux" {
|
|
|
|
|
defer _pty.Close()
|
|
|
|
|
go io.Copy(ch, _pty)
|
|
|
|
|
go io.Copy(_pty, ch)
|
|
|
|
|
} else { // windows
|
|
|
|
|
cmd.Stderr = ch
|
|
|
|
|
cmd.Stdout = ch
|
|
|
|
|
// cmd.Stdin = ch
|
|
|
|
|
|
|
|
|
|
in, err := cmd.StdinPipe()
|
|
|
|
|
if err != nil {
|
|
|
|
|
ch.SendRequest("exit-status", false,
|
|
|
|
|
@ -469,16 +263,14 @@ func handleShell(cmd *exec.Cmd, ch ssh.Channel, _console console.Console, ptsnam
|
|
|
|
|
go func() {
|
|
|
|
|
defer in.Close()
|
|
|
|
|
io.Copy(in, ch)
|
|
|
|
|
|
|
|
|
|
}()
|
|
|
|
|
}
|
|
|
|
|
if err := cmd.Start(); err != nil {
|
|
|
|
|
log.Debugln("start command ", err)
|
|
|
|
|
ch.SendRequest("exit-status", false,
|
|
|
|
|
ssh.Marshal(exitStatus{Status: 126}))
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
code := 0
|
|
|
|
|
if err = cmd.Wait(); err != nil {
|
|
|
|
|
log.Debugln(err)
|
|
|
|
|
@ -488,7 +280,36 @@ func handleShell(cmd *exec.Cmd, ch ssh.Channel, _console console.Console, ptsnam
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
cmd.Process = nil
|
|
|
|
|
ch.SendRequest("exit-status", false,
|
|
|
|
|
ssh.Marshal(exitStatus{Status: uint32(code)}))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func handleCommand(cmd *exec.Cmd, ch ssh.Channel) {
|
|
|
|
|
defer ch.Close()
|
|
|
|
|
|
|
|
|
|
cmd.Stdout = ch
|
|
|
|
|
cmd.Stderr = ch
|
|
|
|
|
//log.Debugln("execute command", cmd)
|
|
|
|
|
in, err := cmd.StdinPipe()
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.Debugln(err)
|
|
|
|
|
ch.SendRequest("exit-status", false,
|
|
|
|
|
ssh.Marshal(exitStatus{Status: 127}))
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
go func() {
|
|
|
|
|
defer in.Close()
|
|
|
|
|
io.Copy(in, ch)
|
|
|
|
|
}()
|
|
|
|
|
code := 0
|
|
|
|
|
if err := cmd.Run(); err != nil {
|
|
|
|
|
log.Debugln(err)
|
|
|
|
|
if exiterr, ok := err.(*exec.ExitError); ok {
|
|
|
|
|
if s, ok := exiterr.Sys().(syscall.WaitStatus); ok {
|
|
|
|
|
code = s.ExitStatus()
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
ch.SendRequest("exit-status", false,
|
|
|
|
|
ssh.Marshal(exitStatus{Status: uint32(code)}))
|
|
|
|
|
}
|
|
|
|
|
@ -564,7 +385,7 @@ func (sc *Server) handleTcpipForward(req *ssh.Request) {
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if addr.Port > 65535 {
|
|
|
|
|
if addr.Port > 65535 || addr.Port < 0 {
|
|
|
|
|
log.Errorf("invalid port %d", addr.Port)
|
|
|
|
|
if req.WantReply {
|
|
|
|
|
req.Reply(false, nil)
|
|
|
|
|
|