1 // Copyright (C) The Arvados Authors. All rights reserved.
3 // SPDX-License-Identifier: AGPL-3.0
22 "git.arvados.org/arvados.git/lib/selfsigned"
23 "git.arvados.org/arvados.git/sdk/go/httpserver"
24 "github.com/creack/pty"
25 "github.com/google/shlex"
26 "golang.org/x/crypto/ssh"
30 DockerContainerID *string
32 Address string // listen host:port; if port=0, Start() will change it to the selected port
35 Printf(fmt string, args ...interface{})
38 sshConfig ssh.ServerConfig
43 // startGatewayServer starts an http server that allows authenticated
44 // clients to open an interactive "docker exec" session and (in
45 // future) connect to tcp ports inside the docker container.
46 func (gw *Gateway) Start() error {
47 gw.sshConfig = ssh.ServerConfig{
49 PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
53 return nil, fmt.Errorf("cannot specify user %q via ssh client", c.User())
55 PublicKeyCallback: func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
57 return &ssh.Permissions{
58 Extensions: map[string]string{
59 "pubkey-fp": ssh.FingerprintSHA256(pubKey),
63 return nil, fmt.Errorf("cannot specify user %q via ssh client", c.User())
66 pvt, err := rsa.GenerateKey(rand.Reader, 2048)
74 signer, err := ssh.NewSignerFromKey(pvt)
78 gw.sshConfig.AddHostKey(signer)
80 // Address (typically provided by arvados-dispatch-cloud) is
81 // HOST:PORT where HOST is our IP address or hostname as seen
82 // from arvados-controller, and PORT is either the desired
83 // port where we should run our gateway server, or "0" if we
84 // should choose an available port.
85 host, port, err := net.SplitHostPort(gw.Address)
89 cert, err := selfsigned.CertGenerator{}.Generate()
93 h := hmac.New(sha256.New, []byte(gw.AuthSecret))
94 h.Write(cert.Certificate[0])
95 gw.requestAuth = fmt.Sprintf("%x", h.Sum(nil))
97 h.Write([]byte(gw.requestAuth))
98 gw.respondAuth = fmt.Sprintf("%x", h.Sum(nil))
100 srv := &httpserver.Server{
102 Handler: http.HandlerFunc(gw.handleSSH),
103 TLSConfig: &tls.Config{
104 Certificates: []tls.Certificate{cert},
113 // Get the port number we are listening on (the port might be
114 // "0" or a port name, in which case this will be different).
115 _, port, err = net.SplitHostPort(srv.Addr)
119 // When changing state to Running, we will set
120 // gateway_address to "HOST:PORT" where HOST is our
121 // external hostname/IP as provided by arvados-dispatch-cloud,
122 // and PORT is the port number we ended up listening on.
123 gw.Address = net.JoinHostPort(host, port)
127 // handleSSH connects to an SSH server that allows the caller to run
128 // interactive commands as root (or any other desired user) inside the
129 // container. The tunnel itself can only be created by an
130 // authenticated caller, so the SSH server itself is wide open (any
131 // password or key will be accepted).
133 // Requests must have path "/ssh" and the following headers:
135 // Connection: upgrade
137 // X-Arvados-Target-Uuid: uuid of container
138 // X-Arvados-Authorization: must match
139 // hmac(AuthSecret,certfingerprint) (this prevents other containers
140 // and shell nodes from connecting directly)
144 // X-Arvados-Detach-Keys: argument to "docker exec --detach-keys",
145 // e.g., "ctrl-p,ctrl-q"
146 // X-Arvados-Login-Username: argument to "docker exec --user": account
147 // used to run command(s) inside the container.
148 func (gw *Gateway) handleSSH(w http.ResponseWriter, req *http.Request) {
149 // In future we'll handle browser traffic too, but for now the
150 // only traffic we expect is an SSH tunnel from
151 // (*lib/controller/localdb.Conn)ContainerSSH()
152 if req.Method != "GET" || req.Header.Get("Upgrade") != "ssh" {
153 http.Error(w, "path not found", http.StatusNotFound)
156 if want := req.Header.Get("X-Arvados-Target-Uuid"); want != gw.ContainerUUID {
157 http.Error(w, fmt.Sprintf("misdirected request: meant for %q but received by crunch-run %q", want, gw.ContainerUUID), http.StatusBadGateway)
160 if req.Header.Get("X-Arvados-Authorization") != gw.requestAuth {
161 http.Error(w, "bad X-Arvados-Authorization header", http.StatusUnauthorized)
164 detachKeys := req.Header.Get("X-Arvados-Detach-Keys")
165 username := req.Header.Get("X-Arvados-Login-Username")
169 hj, ok := w.(http.Hijacker)
171 http.Error(w, "ResponseWriter does not support connection upgrade", http.StatusInternalServerError)
174 netconn, _, err := hj.Hijack()
176 http.Error(w, err.Error(), http.StatusInternalServerError)
179 defer netconn.Close()
180 w.Header().Set("Connection", "upgrade")
181 w.Header().Set("Upgrade", "ssh")
182 w.Header().Set("X-Arvados-Authorization-Response", gw.respondAuth)
183 netconn.Write([]byte("HTTP/1.1 101 Switching Protocols\r\n"))
184 w.Header().Write(netconn)
185 netconn.Write([]byte("\r\n"))
189 conn, newchans, reqs, err := ssh.NewServerConn(netconn, &gw.sshConfig)
191 gw.Log.Printf("ssh.NewServerConn: %s", err)
195 go ssh.DiscardRequests(reqs)
196 for newch := range newchans {
197 if newch.ChannelType() != "session" {
198 newch.Reject(ssh.UnknownChannelType, fmt.Sprintf("unsupported channel type %q", newch.ChannelType()))
201 ch, reqs, err := newch.Accept()
203 gw.Log.Printf("accept channel: %s", err)
206 var pty0, tty0 *os.File
208 // Where to send errors/messages for the
210 logw := io.Writer(ch.Stderr())
211 // How to end lines when sending
212 // errors/messages to the client (changes to
213 // \r\n when using a pty)
215 // Env vars to add to child process
216 termEnv := []string(nil)
217 for req := range reqs {
220 case "shell", "exec":
225 ssh.Unmarshal(req.Payload, &payload)
226 execargs, err := shlex.Split(payload.Command)
228 fmt.Fprintf(logw, "error parsing supplied command: %s"+eol, err)
231 if len(execargs) == 0 {
232 execargs = []string{"/bin/bash", "-login"}
235 cmd := exec.CommandContext(ctx, "docker", "exec", "-i", "--detach-keys="+detachKeys, "--user="+username)
238 cmd.Stderr = ch.Stderr()
240 cmd.Args = append(cmd.Args, "-t")
244 var wg sync.WaitGroup
247 go func() { io.Copy(ch, pty0); wg.Done() }()
248 go func() { io.Copy(pty0, ch); wg.Done() }()
249 // Send our own debug messages to tty as well.
252 cmd.Args = append(cmd.Args, *gw.DockerContainerID)
253 cmd.Args = append(cmd.Args, execargs...)
254 cmd.SysProcAttr = &syscall.SysProcAttr{
255 Setctty: tty0 != nil,
258 cmd.Env = append(os.Environ(), termEnv...)
263 if exiterr, ok := err.(*exec.ExitError); ok {
264 if status, ok := exiterr.Sys().(syscall.WaitStatus); ok {
265 resp.Status = uint32(status.ExitStatus())
267 } else if err != nil {
268 // Propagate errors like `exec: "docker": executable file not found in $PATH`
269 fmt.Fprintln(ch.Stderr(), err)
271 errClose := ch.CloseWrite()
272 if resp.Status == 0 && (err != nil || errClose != nil) {
275 ch.SendRequest("exit-status", false, ssh.Marshal(&resp))
280 p, t, err := pty.Open()
282 fmt.Fprintf(ch.Stderr(), "pty failed: %s"+eol, err)
296 ssh.Unmarshal(req.Payload, &payload)
297 termEnv = []string{"TERM=" + payload.Term, "USE_TTY=1"}
298 err = pty.Setsize(pty0, &pty.Winsize{Rows: uint16(payload.Rows), Cols: uint16(payload.Cols), X: uint16(payload.X), Y: uint16(payload.Y)})
300 fmt.Fprintf(logw, "pty-req: setsize failed: %s"+eol, err)
302 case "window-change":
309 ssh.Unmarshal(req.Payload, &payload)
310 err := pty.Setsize(pty0, &pty.Winsize{Rows: uint16(payload.Rows), Cols: uint16(payload.Cols), X: uint16(payload.X), Y: uint16(payload.Y)})
312 fmt.Fprintf(logw, "window-change: setsize failed: %s"+eol, err)
317 // TODO: implement "env"
318 // requests by setting env
319 // vars in the docker-exec
320 // command (not docker-exec's
321 // own environment, which
322 // would be a gaping security
325 // fmt.Fprintf(logw, "declining %q req"+eol, req.Type)