bfu/glider-ssh
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Disable port forwarding by default

Browse Source 
Fixes #68
This commit is contained in:
Kaleb Elwert 2019-06-12 10:52:26 -07:00
parent 465d1bd2c7
commit dd61f8b0d5
4 changed files with 23 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
server.go
View File

@ -65,6 +65,8 @@ func (f RequestHandlerFunc) HandleSSHRequest(ctx Context, srv *Server, req *goss
return f(ctx, srv, req) return f(ctx, srv, req)
} }
var DefaultRequestHandlers = map[string]RequestHandler{}
type ChannelHandler interface { type ChannelHandler interface {
HandleSSHChannel(srv *Server, conn *gossh.ServerConn, newChan gossh.NewChannel, ctx Context) HandleSSHChannel(srv *Server, conn *gossh.ServerConn, newChan gossh.NewChannel, ctx Context)
} }
@ -75,6 +77,10 @@ func (f ChannelHandlerFunc) HandleSSHChannel(srv *Server, conn *gossh.ServerConn
f(srv, conn, newChan, ctx) f(srv, conn, newChan, ctx)
} }
var DefaultChannelHandlers = map[string]ChannelHandler{
"session": ChannelHandlerFunc(DefaultSessionHandler),
}
func (srv *Server) ensureHostSigner() error { func (srv *Server) ensureHostSigner() error {
if len(srv.HostSigners) == 0 { if len(srv.HostSigners) == 0 {
signer, err := generateSigner() signer, err := generateSigner()
@ -90,15 +96,15 @@ func (srv *Server) ensureHandlers() {
srv.mu.Lock() srv.mu.Lock()
defer srv.mu.Unlock() defer srv.mu.Unlock()
if srv.RequestHandlers == nil { if srv.RequestHandlers == nil {
srv.RequestHandlers = map[string]RequestHandler{ srv.RequestHandlers = map[string]RequestHandler{}
"tcpip-forward": forwardedTCPHandler{}, for k, v := range DefaultRequestHandlers {
"cancel-tcpip-forward": forwardedTCPHandler{}, srv.RequestHandlers[k] = v
} }
} }
if srv.ChannelHandlers == nil { if srv.ChannelHandlers == nil {
srv.ChannelHandlers = map[string]ChannelHandler{ srv.ChannelHandlers = map[string]ChannelHandler{}
"session": ChannelHandlerFunc(sessionHandler), for k, v := range DefaultChannelHandlers {
"direct-tcpip": ChannelHandlerFunc(directTcpipHandler), srv.ChannelHandlers[k] = v
} }
} }
} }

2
session.go
View File

@ -77,7 +77,7 @@ type Session interface {
// when there is no signal channel specified // when there is no signal channel specified
const maxSigBufSize = 128 const maxSigBufSize = 128
func sessionHandler(srv *Server, conn *gossh.ServerConn, newChan gossh.NewChannel, ctx Context) { func DefaultSessionHandler(srv *Server, conn *gossh.ServerConn, newChan gossh.NewChannel, ctx Context) {
ch, reqs, err := newChan.Accept() ch, reqs, err := newChan.Accept()
if err != nil { if err != nil {
// TODO: trigger event callback // TODO: trigger event callback

4
session_test.go
View File

@ -20,8 +20,8 @@ func (srv *Server) serveOnce(l net.Listener) error {
return e return e
} }
srv.ChannelHandlers = map[string]ChannelHandler{ srv.ChannelHandlers = map[string]ChannelHandler{
"session": ChannelHandlerFunc(sessionHandler), "session": ChannelHandlerFunc(DefaultSessionHandler),
"direct-tcpip": ChannelHandlerFunc(directTcpipHandler), "direct-tcpip": ChannelHandlerFunc(DirectTCPIPHandler),
} }
srv.handleConn(conn) srv.handleConn(conn)
return nil return nil

11
tcpip.go
View File

@ -23,7 +23,9 @@ type localForwardChannelData struct {
OriginPort uint32 OriginPort uint32
} }
func directTcpipHandler(srv *Server, conn *gossh.ServerConn, newChan gossh.NewChannel, ctx Context) { // DirectTCPIPHandler can be enabled by adding it to the server's
// ChannelHandlers under direct-tcpip.
func DirectTCPIPHandler(srv *Server, conn *gossh.ServerConn, newChan gossh.NewChannel, ctx Context) {
d := localForwardChannelData{} d := localForwardChannelData{}
if err := gossh.Unmarshal(newChan.ExtraData(), &d); err != nil { if err := gossh.Unmarshal(newChan.ExtraData(), &d); err != nil {
newChan.Reject(gossh.ConnectionFailed, "error parsing forward data: "+err.Error()) newChan.Reject(gossh.ConnectionFailed, "error parsing forward data: "+err.Error())
@ -84,12 +86,15 @@ type remoteForwardChannelData struct {
OriginPort uint32 OriginPort uint32
} }
type forwardedTCPHandler struct { // ForwardedTCPHandler can be enabled by creating a ForwardedTCPHandler and
// adding it to the server's RequestHandlers under tcpip-forward and
// cancel-tcpip-forward.
type ForwardedTCPHandler struct {
forwards map[string]net.Listener forwards map[string]net.Listener
sync.Mutex sync.Mutex
} }
func (h forwardedTCPHandler) HandleSSHRequest(ctx Context, srv *Server, req *gossh.Request) (bool, []byte) { func (h ForwardedTCPHandler) HandleSSHRequest(ctx Context, srv *Server, req *gossh.Request) (bool, []byte) {
h.Lock() h.Lock()
if h.forwards == nil { if h.forwards == nil {
h.forwards = make(map[string]net.Listener) h.forwards = make(map[string]net.Listener)