ssh.go

package main

import (
	"fmt"
	"golang.org/x/crypto/ssh"
	"io"
	"log"
	"net"
	"os"
	"sync"
	//	"crypto/md5"
	"encoding/hex"
)

type DefAuth struct {
	service string
	name    string
	token   string
	state   bool
}

var GenAuth []DefAuth

var sshChannelsMonitor []*ssh.Channel
var sshChannelsSerial []*ssh.Channel

func ssh_init(nMonitor, nSerial int) {
	sshChannelsMonitor = make([]*ssh.Channel, nMonitor)
	sshChannelsSerial = make([]*ssh.Channel, nSerial)
}

func checkPerm(token string, service string) bool {
	for _, i := range GenAuth {
		if (token == i.token) && (service == i.service) {
			return i.state
		}
	}
	return false
}

func SSHHandler(sshcfg SSHCFG, desc string, r *Router, def_aut bool) {
	debugPrint(log.Printf, levelDebug, "request descr=%s", desc)
	authorizedKeysBytes, err := os.ReadFile(sshcfg.Authorized_keys)
	if err != nil {
		log.Fatalf("SSH %s: failed to load authorized_keys: %v", desc, err)
	}

	authorizedKeysMap := map[string]bool{}
	for len(authorizedKeysBytes) > 0 {
		pubKey, comment, _, rest, err := ssh.ParseAuthorizedKey(authorizedKeysBytes)
		if err != nil {
			log.Fatalf("SSH %s: invalid authorized_keys format: %v", desc, err)
		}
		debugPrint(log.Printf, levelDebug, "add key for %s", comment) //hex.EncodeToString(pubKey.Marshal())
		GenAuth = append(GenAuth, DefAuth{
			service: desc,
			name:    comment,
			token:   hex.EncodeToString(pubKey.Marshal()),
			state:   def_aut,
		})
		authorizedKeysMap[string(pubKey.Marshal())] = true
		authorizedKeysBytes = rest
	}
	config := &ssh.ServerConfig{
		PublicKeyCallback: func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
			if authorizedKeysMap[string(pubKey.Marshal())] {
				debugPrint(log.Printf, levelDebug, "Authorized user attempt check permissions")
				if checkPerm(hex.EncodeToString(pubKey.Marshal()), desc) {
					return &ssh.Permissions{
						Extensions: map[string]string{
							"pubkey-fp": ssh.FingerprintSHA256(pubKey),
						},
					}, nil
				} else {
					return nil, fmt.Errorf("unauthorized user")
				}
			}
			return nil, fmt.Errorf("unknown public key for %q", c.User())
		},
	}

	privateBytes, err := os.ReadFile(sshcfg.IdentitFn)
	if err != nil {
		log.Fatalf("SSH %s: failed to load private key: %v", desc, err)
	}
	private, err := ssh.ParsePrivateKey(privateBytes)
	if err != nil {
		log.Fatalf("SSH %s: failed to parse private key: %v", desc, err)
	}
	config.AddHostKey(private)

	listener, err := net.Listen("tcp4", "0.0.0.0:"+sshcfg.Port)
	if err != nil {
		log.Fatalf("SSH %s: failed to listen: %v", desc, err)
	}
	defer listener.Close()

	debugPrint(log.Printf, levelWarning, "Starting %s SSH server on port %s\n", desc, sshcfg.Port)

	for {
		conn, err := listener.Accept()
		if err != nil {
			debugPrint(log.Printf, levelPanic, "failed to accept incoming connection: %s", err.Error())
		}

		go handleSSHConnection(conn, config, r, desc)
	}
}

func checkBrokenConnections(conn ssh.Conn, r *Router, n int, desc string) {
	conn.Wait()
	r.DetachAt(n)
	debugPrint(log.Printf, levelInfo, "Closing broken connection, detach %d", n)
	conn.Close()
}

func handleSSHConnection(conn net.Conn, config *ssh.ServerConfig, r *Router, desc string) {
	defer conn.Close()

	debugPrint(log.Printf, levelDebug, "request descr=%s", desc)
	sshConn, chans, reqs, err := ssh.NewServerConn(conn, config)
	if err != nil {
		debugPrint(log.Printf, levelError, "failed to establish SSH connection: %s", err.Error())
		return
	}
	defer sshConn.Close()

	n, err := r.GetFreePos()
	if err == nil {
		debugPrint(log.Printf, levelDebug, "The new channels in router for this connection are at %d", n)
		r.AttachAt(n, SrcHuman)
		go checkBrokenConnections(sshConn, r, n, desc)
		go ssh.DiscardRequests(reqs)

		for newChannel := range chans {
			go handleSSHChannel(newChannel, r, n, desc)
		}
	} else {
		debugPrint(log.Printf, levelWarning, "Failed to get new channels in router")
	}
}

func handleSSHChannel(newChannel ssh.NewChannel, r *Router, nchan int, desc string) {
	if newChannel.ChannelType() != "session" {
		newChannel.Reject(ssh.UnknownChannelType, "unknown channel type")
		return
	}

	channel, _, err := newChannel.Accept()
	if err != nil {
		debugPrint(log.Printf, levelError, "failed to accept channel: %s", err.Error())
		return
	}
	if desc == "monitor" {
		sshChannelsMonitor[nchan] = &channel
	} else {
		sshChannelsSerial[nchan] = &channel
	}
	defer channel.Close()

	var wg sync.WaitGroup

	wg.Add(1)
	go func() {
		defer wg.Done()
		for {
			data := <-r.In[nchan] //sshOut
			_, err := channel.Write([]byte{data})
			if err != nil {
				if err != io.EOF {
					debugPrint(log.Printf, levelError, "Error writing to SSH channel: %s", err.Error())
				}
				return
			}
		}
	}()

	wg.Add(1)
	go func() {
		defer wg.Done()
		buf := make([]byte, 4096)
		for {
			n, err := channel.Read(buf)
			if err != nil {
				if err != io.EOF {
					debugPrint(log.Printf, levelError, "Error reading from SSH channel: %s", err.Error())
				}
				return
			}
			if n > 0 {
				debugPrint(log.Printf, levelCrazy, "read %d bytes = '%s'", len(buf), string(buf[:n]))
				for i := 0; i < n; i++ {
					r.Out[nchan] <- buf[i] //sshIn
				}
			}
		}
	}()

	wg.Wait()
}