Is there a Interact() interface ?

[cedarwu]

How to gives control of the child process to the interactive user (the human at the keyboard) like the interact method in expect/pexpect?
https://wiki.tcl-lang.org/page/interact

[hinshun]

Send os.Stdin into the expect.Console. This library is a bit lower level so we expect users to decide how to manage the IO and spawn the child processes.

[cedarwu]

Can't make the child shell work as normal, could you please give some advice?
The shell works, but completion and ctrl-c does not work.

Code as following:
First, make expect to login into another machine, then forward all signals to subprocess and wait for finish.

package main

import (
	"log"
	"os"
	"os/exec"
	"os/signal"
	"syscall"

	expect "github.com/Netflix/go-expect"
)

func main() {
	c, err := expect.NewConsole(expect.WithStdout(os.Stdout), expect.WithStdin(os.Stdin))
	if err != nil {
		log.Fatal(err)
	}
	defer c.Close()

	cmd := exec.Command("ssh", "root@ip", "-i", "~/.ssh/id_rsa")
	cmd.Stdin = c.Tty()
	cmd.Stdout = c.Tty()
	cmd.Stderr = c.Tty()

	err = cmd.Start()
	if err != nil {
		log.Fatal(err)
	}

	_, err = c.ExpectString("[root@")
	if err != nil {
		log.Fatalln("expect err: [root@")
		return
	}

	// wait for the command to finish
	waitCh := make(chan error, 1)
	go func() {
		c.ExpectEOF()
		waitCh <- cmd.Wait()
		close(waitCh)
	}()

	sigChan := make(chan os.Signal, 1)
	signal.Notify(sigChan)

	// You need a for loop to handle multiple signals
	for {
		select {
		case sig := <-sigChan:
			if err := cmd.Process.Signal(sig); err != nil {
				log.Println("error sending signal", sig, err)
			}
		case err := <-waitCh:
			log.Println("subprocess exited")
			var waitStatus syscall.WaitStatus
			if exitError, ok := err.(*exec.ExitError); ok {
				waitStatus = exitError.Sys().(syscall.WaitStatus)
				os.Exit(waitStatus.ExitStatus())
			}
			if err != nil {
				log.Fatal(err)
			}
			break
		}
	}
}

[bmodotdev]

First off, thank your for the amazing library. I caught myself implementing a similar, much less rounded, version of expect when I stumbled across this project.

I too needed an interactive option, so I thought I would share a thorough example of this library with SSH. My use case is an SSH bastion or "jump box", which provides access to servers without disclosing credentials to its users. I need to execute some commands via expect, and if things go well, allow the user to take over the shell.

First, we need to export some credentials used to configure our test environment, and to access it via Go:

export SSH_HOST=localhost SSH_PORT=2222 SSH_USER=wheel SSH_PASS=hunter2 WHEEL_PASS=hunter2

Build a test environment using our exported variables (paste this as one big command):

podman build -t ssh_test --build-arg USER="$SSH_USER" --build-arg PASS="$SSH_PASS" -f - . <<'EOF'
FROM docker.io/debian:stable-slim
ARG USER
ARG PASS
RUN apt-get update && apt-get install -y openssh-server sudo
RUN mkdir -p /run/sshd
RUN useradd -m -s /bin/bash -G sudo "$USER"
RUN printf '%s:%s\n' "$USER" "$PASS" | chpasswd
CMD ["/usr/sbin/sshd","-D"]
EOF

Run the test environment:

podman run -d --rm -p "$SSH_PORT":22 -it ssh_test

My example uses a session log that records input and output, but also has a separate error log. So I recommend tailing these logs in one shell, while your run the example in another shell:

touch session.txt error.txt && tail -fn0 session.txt error.txt 

Run the example (I issued ls, tab'ed to see the completion, and CTRL+C to cancel the ls):

go run example_ssh_sudo.go
$ sudo -p 'PASSWORD_PROMPT_51121377:' su -l -c "printf 'SUDO_' && printf 'SUCCESS_51121377\n' && /bin/bash" -; exit || (printf 'SUDO_FAIL_' && printf '51121377\n')
PASSWORD_PROMPT_51121377:
SUDO_SUCCESS_51121377
root@08e3002e979a:~# ls .
./             ../            .bash_history  .bashrc        .profile       .ssh/
root@08e3002e979a:~# ls .^C
root@08e3002e979a:~# exit
exit

Now, we can export a different wheel password to test the failure path:

export WHEEL_PASS=foo

go run example_ssh_sudo.go
$ sudo -p 'PASSWORD_PROMPT_71028402:' su -l -c "printf 'SUDO_' && printf 'SUCCESS_71028402\n' && /bin/bash" -; exit || (printf 'SUDO_FAIL_' && printf '71028402\n')
PASSWORD_PROMPT_71028402:
Sorry, try again.
PASSWORD_PROMPT_71028402:
Sorry, try again.

PASSWORD_PROMPT_71028402:
sudo: 3 incorrect password attempts

Finally, the example:

package main

import (
	"bytes"
	"errors"
	"fmt"
	"io"
	"log/slog"
	"math/rand"
	"net"
	"os"
	"regexp"
	"time"

	expect "github.com/Netflix/go-expect"
	"golang.org/x/crypto/ssh"
	"golang.org/x/term"
)

type (
	// A convience interface for crafting a sudo command and related outputs that
	// may resilt from running the command.
	Sudoer interface {
		Cmd() string     // Provides our sudo command
		Fail() string    // Provides our expected output if sudo fails
		Prompt() string  // Provides our expected prompt if password is required
		Success() string // Provides our expected output if sudo succeeds
	}

	sudo struct {
		salt string
	}
)

var (
	logger      *slog.Logger
	promptRegex = regexp.MustCompile(`[\]~]?[\$#]`) // Command prompts we expect “~$”, “~#”, “]$”, “]#”

	DefaultTimeout = time.Second * 5

	// We leverage errors to break out of expect loops.
	ErrSudoTryAgain = errors.New("Sudo paassword invalid; try again")
	ErrSudoBadPass  = errors.New("Sudo password invalid")
	ErrSudoFail     = errors.New("Sudo was unsuccessful")
)

func main() {

	// Open error log
	errLog, err := getLogHandle("error.txt")
	if err != nil {
		return
	}
	defer errLog.Close()
	logger = slog.New(slog.NewJSONHandler(errLog, nil))

	// Open session log
	sessionLog, err := getLogHandle("session.txt")
	if err != nil {
		logger.Error("Failed to open session log", "err", err)
		return
	}
	defer sessionLog.Close()

	// Create our pipes
	stdinPipeReader, stdinPipeWriter := io.Pipe()
	stdoutPipeReader, stdoutPipeWriter := io.Pipe()

	// Initialize our expect console
	console, err := expect.NewConsole(expect.WithDefaultTimeout(DefaultTimeout))
	if err != nil {
		logger.Error("Failed to get expect console", "err", err)
		return
	}
	defer console.Close()

	// Connect stdout pipe reader, session log, and expect to os.Stdout
	go func() {
		w := io.MultiWriter(os.Stdout, sessionLog, console.Tty())
		_, _ = io.Copy(w, stdoutPipeReader)

		// console.Tty() will return fs.ErrClosed once we call console.Close(); i.e,
		// when we go interactive. Reapply our Copy.
		w = io.MultiWriter(os.Stdout, sessionLog)
		if _, err = io.Copy(w, stdoutPipeReader); err != nil {
			logger.Error("Failed to write to stdout/sessionlog multiwriter", "err", err)
		}
	}()

	// Conect expect to stdin pipe writer
	go func() {
		_, _ = io.Copy(stdinPipeWriter, console.Tty())
	}()

	// Get session
	client, session, err := getSession(stdinPipeReader, stdoutPipeWriter, stdoutPipeWriter)
	if err != nil {
		logger.Error("Failed to get session", "err", err)
		return
	}
	defer client.Close()
	defer session.Close()

	// Configure PTY
	ptyCloser, err := getPTY(session)
	if err != nil {
		logger.Error("Failed to get PTY", "err", err)
		return
	}
	defer ptyCloser()

	if err = session.Start("/bin/sh"); err != nil {
		logger.Error("Failed to start command", "err", err)
		return
	}

	// Verify we recieved a prompt; remote server may be slow or under heavy load.
	if _, err = console.Expect(expect.Regexp(promptRegex)); err != nil {
		logger.Error("Failed to get prompt", "err", err)
		return
	}

	// Switch to root
	if err = getRoot(console); err != nil {
		logger.Info("Failed to get root", "err", err)
		return
	}
	console.Close()

	// Go interactive - connect os.Stdin to stdin pipe writer
	go func() {
		if _, err = io.Copy(stdinPipeWriter, os.Stdin); err != nil {
			logger.Error("Failed to write to stdinPipeWriter from os.Stdin", "err", err)
		}
	}()

	_ = session.Wait()
}

func getRoot(console *expect.Console) (err error) {
	sudoer := NewSudoer()
	if _, err = console.SendLine(sudoer.Cmd()); err != nil {
		logger.Error("Failed to send cmd to switch to root", "err", err)
		return err
	}

	_, err = console.Expect(
		// Is a password required?
		expect.String(sudoer.Prompt()).Then(func(_ *bytes.Buffer) error {

			// It seems echo is disabled after presenting the password prompt, which
			// means we could provide the password before echo is disabled,
			// accidentially disclosing the password.
			time.Sleep(time.Second)
			if _, err = console.SendLine(os.Getenv("WHEEL_PASS")); err != nil {
				return err
			}

			// We cannot control how many times we may be prompted for an incorect password.
			// Typically, this is 3 times; however, set a hard limit of 5.
			for i := 0; i < 5; i++ {
				_, err = console.Expect(
					expect.String(sudoer.Success()),
					expect.String(sudoer.Fail()).Then(callbackSudoFail),
					expect.String("try again").Then(getCallbackSudoTryAgain(console)),
					expect.String("incorrect password attempts").Then(callbackSudoBadPass),
				)
				if err == nil || !errors.Is(err, ErrSudoTryAgain) {
					break
				}
			}
			return err
		}),
		expect.String(sudoer.Success()),
		expect.String(sudoer.Fail()).Then(callbackSudoFail),
	)
	return err
}

func getPTY(session *ssh.Session) (closerFn func(), err error) {
	fd := int(os.Stdin.Fd())
	if !term.IsTerminal(fd) {
		return nil, nil
	}

	state, err := term.MakeRaw(fd)
	if err != nil {
		return nil, err
	}

	width, height, err := term.GetSize(fd)
	if err != nil {
		return nil, err
	}

	modes := ssh.TerminalModes{
		ssh.ECHO:          1,
		ssh.TTY_OP_ISPEED: 14400,
		ssh.TTY_OP_OSPEED: 14400,
	}

	if err = session.RequestPty("xterm-256color", height, width, modes); err != nil {
		return nil, err
	}

	closerFn = func() {
		if err := term.Restore(fd, state); err != nil {
			logger.Error("Failed to restore PTY", "err", err)
		}
	}
	return closerFn, err
}

func getSession(stdin io.Reader, stdout, stderr io.Writer) (client *ssh.Client, session *ssh.Session, err error) {
	config := ssh.ClientConfig{
		User:            os.Getenv("SSH_USER"),
		Auth:            []ssh.AuthMethod{ssh.Password(os.Getenv("SSH_PASS"))},
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}

	client, err = ssh.Dial("tcp", net.JoinHostPort(os.Getenv("SSH_HOST"), os.Getenv("SSH_PORT")), &config)
	if err != nil {
		return nil, nil, err
	}

	session, err = client.NewSession()
	if err != nil {
		client.Close()
		return nil, nil, err
	}

	session.Stdin = stdin
	session.Stdout = stdout
	session.Stderr = stderr

	return client, session, err
}

func getLogHandle(path string) (w io.WriteCloser, err error) {
	w, err = os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0640)
	return w, err
}

func callbackSudoFail(_ *bytes.Buffer) error {
	return ErrSudoFail
}

func callbackSudoBadPass(_ *bytes.Buffer) error {
	return ErrSudoBadPass
}

// Sending the same password will not resolve incorrect password.
// Defensively send an empty string.
func getCallbackSudoTryAgain(console *expect.Console) expect.ConsoleCallback {
	return func(_ *bytes.Buffer) error {
		_, _ = console.SendLine("")
		return ErrSudoTryAgain
	}
}

func NewSudoer() Sudoer {
	return &sudo{salt: fmt.Sprintf("%08d", rand.Intn(100000000))}
}

func (s *sudo) Cmd() string {
	return fmt.Sprintf(
		`sudo -p '%s' su -l -c "printf 'SUDO_' && printf 'SUCCESS_%s\n' && /bin/bash" -; exit `+
			`|| (printf 'SUDO_FAIL_' && printf '%s\n')`,
		s.Prompt(), s.salt, s.salt,
	)
}

func (s *sudo) Success() string {
	return fmt.Sprintf("SUDO_SUCCESS_%s", s.salt)
}

func (s *sudo) Fail() string {
	return fmt.Sprintf("SUDO_FAIL_%s", s.salt)
}

func (s *sudo) Prompt() string {
	return fmt.Sprintf("PASSWORD_PROMPT_%s:", s.salt)
}

While it's common practice to use expect with an SSH binary, Go has a solid, albeit external, SSH package golang.org/x/crypto/ssh. IMHO, using crypto/ssh makes for an easier and more robust experience(signals and tab completion) opposed to using an SSH binary from the system. If you require using an SSH binary, and need signals/tab completion, my guess would be that you must force a PTY via ssh -t or ssh -tt.

Also, expect has WithStdin() and WithStdout() which could be used here in place of io.Pipe(); however, in my use case, the usage of expect is quite minimal, a few commands to setup the session, with the bulk being interactive work by the user. So I preferred to not push input/output through expect.Console for the entire session, rather push to it via io.MultiWriter(), call Console.Close(), and expect my multiwriter to fail.

Please feel free to share any feedback. I am also happy to submit a PR if an example like this is welcome.