|
| 1 | +import * as http from "http" |
| 2 | +import * as net from "net" |
| 3 | +import * as ssh from "ssh2" |
| 4 | +import * as ws from "ws" |
| 5 | +import * as fs from "fs" |
| 6 | +import { logger } from "@coder/logger" |
| 7 | +import safeCompare from "safe-compare" |
| 8 | +import { HttpProvider, HttpResponse, HttpProviderOptions, Route } from "../http" |
| 9 | +import { HttpCode } from "../../common/http" |
| 10 | +import { forwardSshPort, fillSshSession } from "./ssh" |
| 11 | +import { hash } from "../util" |
| 12 | + |
| 13 | +export class SshProvider extends HttpProvider { |
| 14 | + private readonly wss = new ws.Server({ noServer: true }) |
| 15 | + private sshServer: ssh.Server |
| 16 | + |
| 17 | + public constructor(options: HttpProviderOptions, hostKeyPath: string) { |
| 18 | + super(options) |
| 19 | + const hostKey = fs.readFileSync(hostKeyPath) |
| 20 | + this.sshServer = new ssh.Server({ hostKeys: [hostKey] }, this.handleSsh) |
| 21 | + |
| 22 | + this.sshServer.on("error", (err) => { |
| 23 | + logger.error(`SSH server error: ${err.stack}`) |
| 24 | + }) |
| 25 | + } |
| 26 | + |
| 27 | + public async listen(): Promise<string> { |
| 28 | + return new Promise((resolve, reject) => { |
| 29 | + this.sshServer.once("error", reject) |
| 30 | + this.sshServer.listen(() => { |
| 31 | + resolve(this.sshServer.address().port.toString()) |
| 32 | + }) |
| 33 | + }) |
| 34 | + } |
| 35 | + |
| 36 | + public async handleRequest(): Promise<HttpResponse> { |
| 37 | + // SSH has no HTTP endpoints |
| 38 | + return { code: HttpCode.NotFound } |
| 39 | + } |
| 40 | + |
| 41 | + public handleWebSocket( |
| 42 | + _route: Route, |
| 43 | + request: http.IncomingMessage, |
| 44 | + socket: net.Socket, |
| 45 | + head: Buffer, |
| 46 | + ): Promise<void> { |
| 47 | + // Create a fake websocket to the sshServer |
| 48 | + const sshSocket = net.connect(this.sshServer.address().port, "localhost") |
| 49 | + |
| 50 | + return new Promise((resolve) => { |
| 51 | + this.wss.handleUpgrade(request, socket, head, (ws) => { |
| 52 | + // Send SSH data to WS as compressed binary |
| 53 | + sshSocket.on("data", (data) => { |
| 54 | + ws.send(data, { |
| 55 | + binary: true, |
| 56 | + compress: true, |
| 57 | + fin: true, |
| 58 | + }) |
| 59 | + }) |
| 60 | + |
| 61 | + // Send WS data to SSH as buffer |
| 62 | + ws.on("message", (msg) => { |
| 63 | + // Buffer.from is cool with all types, but casting as string keeps typing simple |
| 64 | + sshSocket.write(Buffer.from(msg as string)) |
| 65 | + }) |
| 66 | + |
| 67 | + ws.on("error", (err) => { |
| 68 | + logger.error(`SSH websocket error: ${err.stack}`) |
| 69 | + }) |
| 70 | + |
| 71 | + resolve() |
| 72 | + }) |
| 73 | + }) |
| 74 | + } |
| 75 | + |
| 76 | + /** |
| 77 | + * Determine how to handle incoming SSH connections. |
| 78 | + */ |
| 79 | + private handleSsh = (client: ssh.Connection, info: ssh.ClientInfo): void => { |
| 80 | + logger.debug(`Incoming SSH connection from ${info.ip}`) |
| 81 | + client.on("authentication", (ctx) => { |
| 82 | + // Allow any auth to go through if we have no password |
| 83 | + if (!this.options.password) { |
| 84 | + return ctx.accept() |
| 85 | + } |
| 86 | + |
| 87 | + // Otherwise require the same password as code-server |
| 88 | + if (ctx.method === "password") { |
| 89 | + if ( |
| 90 | + safeCompare(this.options.password, hash(ctx.password)) || |
| 91 | + safeCompare(this.options.password, ctx.password) |
| 92 | + ) { |
| 93 | + return ctx.accept() |
| 94 | + } |
| 95 | + } |
| 96 | + |
| 97 | + // Reject, letting them know that password is the only method we allow |
| 98 | + ctx.reject(["password"]) |
| 99 | + }) |
| 100 | + client.on("tcpip", forwardSshPort) |
| 101 | + client.on("session", fillSshSession) |
| 102 | + client.on("error", (err) => { |
| 103 | + // Don't bother logging Keepalive errors, they probably just disconnected |
| 104 | + if (err.message === "Keepalive timeout") { |
| 105 | + return logger.debug("SSH client keepalive timeout") |
| 106 | + } |
| 107 | + logger.error(`SSH client error: ${err.stack}`) |
| 108 | + }) |
| 109 | + } |
| 110 | +} |
0 commit comments