smart_proxy_remote_execution_ssh 0.1.6 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: f1fa864f93c540a4c0c0e1cb837c4ed96962bc5d
-  data.tar.gz: 8e25bfe21c97d5b15039c6396eb18d86ee3d0eb8
+SHA256:
+  metadata.gz: a04bba60b9857717faf87e96b17f1734feb66dab9ab009517843d843868791ec
+  data.tar.gz: 27a2bc2d81c77709a4a414f04c7ee1dbcbdbe532727c2083b2734384e4b80c3e
 SHA512:
-  metadata.gz: f525bf0fcd9c1ebd907bd18c18cda1619641f3284b8e908273f950d9b8e5bd2ddddfcee1ab72c1a8f0aab12433670effea419bf7df5c5cb69a8761b135f4349c
-  data.tar.gz: eee8395b05faed6a1b0889dc46d3c4a1a73807187701d8c505b4bc8650573d3507aeda0e9de92401cefaac2442a46c0d68dd53a88b9ed882b779a1b23d41f8ad
+  metadata.gz: 3b9bd1e86b27273b27de65083052611fc4de5eb012705f2f0b31a5e77843b647d81fd67c10bd28abcb22d928e1db65bb6c18131fb872cb4bdaac4fd319061dde
+  data.tar.gz: 20596fd3597915a897eac49051c45228c12fb91753164c23d64b8f7cccefbe1b6567f4e2b5620edebe7108bf7063b61ea037c55ecdc7d87c4177862ca56413fc

data/README.md

@@ -51,7 +51,7 @@ The simplest thing one can do is just to trigger a command:
 ```
 curl http://my-proxy.example.com:9292/dynflow/tasks \
       -X POST -H 'Content-Type: application/json'\
-      -d '{"action_name":  "Proxy::RemoteExecution::Ssh::CommandAction",
+      -d '{"action_name":  "ForemanRemoteExecutionCore::Actions::RunScript",
            "action_input": {"task_id" : "1234'$RANDOM'",
                             "script": "/usr/bin/ls",
                             "hostname": "localhost",

data/lib/smart_proxy_remote_execution_ssh.rb

@@ -1,5 +1,6 @@
 require 'smart_proxy_remote_execution_ssh/version'
 require 'smart_proxy_dynflow'
+require 'smart_proxy_remote_execution_ssh/webrick_ext'
 require 'smart_proxy_remote_execution_ssh/plugin'
 
 module Proxy::RemoteExecution

data/lib/smart_proxy_remote_execution_ssh/api.rb

@@ -1,9 +1,42 @@
+require 'net/ssh'
+require 'base64'
+
 module Proxy::RemoteExecution
   module Ssh
+
     class Api < ::Sinatra::Base
+      include Sinatra::Authorization::Helpers
+
       get "/pubkey" do
         File.read(Ssh.public_key_file)
       end
+
+      post "/session" do
+        do_authorize_any
+        session = Cockpit::Session.new(env)
+        unless session.valid?
+          return [ 400, "Invalid request: /ssh/session requires connection upgrade to 'raw'" ]
+        end
+        session.hijack!
+        101
+      end
+
+      delete '/known_hosts/:name' do |name|
+        do_authorize_any
+        keys = Net::SSH::KnownHosts.search_for(name)
+        return [204] if keys.empty?
+        ssh_keys = keys.map { |key| Base64.strict_encode64 key.to_blob }
+        Net::SSH::KnownHosts.hostfiles({}, :user)
+          .map { |file| File.expand_path file }
+          .select { |file| File.readable?(file) && File.writable?(file) }
+          .each do |host_file|
+            lines = File.foreach(host_file).reject do |line|
+              ssh_keys.any? { |key| line.end_with? "#{key}\n" }
+            end
+            File.open(host_file, 'w') { |f| f.write lines.join }
+          end
+        204
+      end
     end
   end
 end

data/lib/smart_proxy_remote_execution_ssh/cockpit.rb

@@ -0,0 +1,269 @@
+require 'net/ssh'
+require 'forwardable'
+
+module Proxy::RemoteExecution
+  module Cockpit
+    # A wrapper class around different kind of sockets to comply with Net::SSH event loop
+    class BufferedSocket
+      include Net::SSH::BufferedIo
+      extend Forwardable
+
+      # The list of methods taken from OpenSSL::SSL::SocketForwarder for the object to act like a socket
+      def_delegators(:@socket, :to_io, :addr, :peeraddr, :setsockopt,
+                     :getsockopt, :fcntl, :close, :closed?, :do_not_reverse_lookup=)
+
+      def initialize(socket)
+        @socket = socket
+        initialize_buffered_io
+      end
+
+      def recv
+        raise NotImplementedError
+      end
+
+      def send
+        raise NotImplementedError
+      end
+
+      def self.applies_for?(socket)
+        raise NotImplementedError
+      end
+
+      def self.build(socket)
+        klass = [OpenSSLBufferedSocket, MiniSSLBufferedSocket, StandardBufferedSocket].find do |potential_class|
+          potential_class.applies_for?(socket)
+        end
+        raise "No suitable implementation of buffered socket available for #{socket.inspect}" unless klass
+        klass.new(socket)
+      end
+    end
+
+    class StandardBufferedSocket < BufferedSocket
+      def_delegators(:@socket, :send, :recv)
+
+      def self.applies_for?(socket)
+        socket.respond_to?(:send) && socket.respond_to?(:recv)
+      end
+    end
+
+    class OpenSSLBufferedSocket < BufferedSocket
+      def self.applies_for?(socket)
+        socket.is_a? ::OpenSSL::SSL::SSLSocket
+      end
+      def_delegators(:@socket, :read_nonblock, :write_nonblock, :close)
+
+      def recv(n)
+        res = ""
+        begin
+          # To drain a SSLSocket before we can go back to the event
+          # loop, we need to repeatedly call read_nonblock; a single
+          # call is not enough.
+          loop do
+            res += @socket.read_nonblock(n)
+          end
+        rescue IO::WaitReadable
+          # Sometimes there is no payload after reading everything
+          # from the underlying socket, but a empty string is treated
+          # as EOF by Net::SSH. So we block a bit until we have
+          # something to return.
+          if res == ""
+            IO.select([@socket.to_io])
+            retry
+          else
+            res
+          end
+        rescue IO::WaitWritable
+          # A renegotiation is happening, let it proceed.
+          IO.select(nil, [@socket.to_io])
+          retry
+        end
+      end
+
+      def send(mesg, flags)
+        @socket.write_nonblock(mesg)
+      rescue IO::WaitWritable
+        0
+      rescue IO::WaitReadable
+        IO.select([@socket.to_io])
+        retry
+      end
+    end
+
+    class MiniSSLBufferedSocket < BufferedSocket
+      def self.applies_for?(socket)
+        socket.is_a? ::Puma::MiniSSL::Socket
+      end
+      def_delegators(:@socket, :read_nonblock, :write_nonblock, :close)
+
+      def recv(n)
+        @socket.read_nonblock(n)
+      end
+
+      def send(mesg, flags)
+        @socket.write_nonblock(mesg)
+      end
+
+      def closed?
+        @socket.to_io.closed?
+      end
+    end
+
+    class Session
+      include ::Proxy::Log
+
+      def initialize(env)
+        @env = env
+      end
+
+      def valid?
+        @env["HTTP_CONNECTION"] == "upgrade" && @env["HTTP_UPGRADE"].to_s.split(',').any? { |part| part.strip == "raw" }
+      end
+
+      def hijack!
+        @socket = nil
+        if @env['ext.hijack!']
+          @socket = @env['ext.hijack!'].call
+        elsif @env['rack.hijack?']
+          begin
+            @env['rack.hijack'].call
+          rescue NotImplementedError
+          end
+          @socket = @env['rack.hijack_io']
+        end
+        raise 'Internal error: request hijacking not available' unless @socket
+        ssh_on_socket
+      end
+
+      private
+
+      def ssh_on_socket
+        with_error_handling { start_ssh_loop }
+      end
+
+      def with_error_handling
+        yield
+      rescue Net::SSH::AuthenticationFailed => e
+        send_error(401, e.message)
+      rescue Errno::EHOSTUNREACH
+        send_error(400, "No route to #{host}")
+      rescue SystemCallError => e
+        send_error(400, e.message)
+      rescue SocketError => e
+        send_error(400, e.message)
+      rescue Exception => e
+        logger.error e.message
+        logger.debug e.backtrace.join("\n")
+        send_error(500, "Internal error") unless @started
+      ensure
+        unless buf_socket.closed?
+          buf_socket.wait_for_pending_sends
+          buf_socket.close
+        end
+      end
+
+      def start_ssh_loop
+        err_buf = ""
+
+        Net::SSH.start(host, ssh_user, ssh_options) do |ssh|
+          channel = ssh.open_channel do |ch|
+            ch.exec(command) do |ch, success|
+              raise "could not execute command" unless success
+
+              ssh.listen_to(buf_socket)
+
+              ch.on_process do
+                if buf_socket.available.positive?
+                  ch.send_data(buf_socket.read_available)
+                end
+                if buf_socket.closed?
+                  ch.close
+                end
+              end
+
+              ch.on_data do |ch2, data|
+                send_start
+                buf_socket.enqueue(data)
+              end
+
+              ch.on_request('exit-status') do |ch, data|
+                code = data.read_long
+                send_start if code.zero?
+                err_buf += "Process exited with code #{code}.\r\n"
+                ch.close
+              end
+
+              ch.on_request('exit-signal') do |ch, data|
+                err_buf += "Process was terminated with signal #{data.read_string}.\r\n"
+                ch.close
+              end
+
+              ch.on_extended_data do |ch2, type, data|
+                err_buf += data
+              end
+            end
+          end
+
+          channel.wait
+          send_error(400, err_buf) unless @started
+        end
+      end
+
+      def send_start
+        unless @started
+          @started = true
+          buf_socket.enqueue("Status: 101\r\n")
+          buf_socket.enqueue("Connection: upgrade\r\n")
+          buf_socket.enqueue("Upgrade: raw\r\n")
+          buf_socket.enqueue("\r\n")
+        end
+      end
+
+      def send_error(code, msg)
+        buf_socket.enqueue("Status: #{code}\r\n")
+        buf_socket.enqueue("Connection: close\r\n")
+        buf_socket.enqueue("\r\n")
+        buf_socket.enqueue(msg)
+      end
+
+      def params
+        @params ||= MultiJson.load(@env["rack.input"].read)
+      end
+
+      def key_file
+        @key_file ||= Proxy::RemoteExecution::Ssh.private_key_file
+      end
+
+      def buf_socket
+        @buffered_socket ||= BufferedSocket.build(@socket)
+      end
+
+      def command
+        params["command"]
+      end
+
+      def ssh_user
+        params["ssh_user"]
+      end
+
+      def host
+        params["hostname"]
+      end
+
+      def ssh_options
+        auth_methods = %w[publickey]
+        auth_methods.unshift('password') if params["ssh_password"]
+
+        ret = {}
+        ret[:port] = params["ssh_port"] if params["ssh_port"]
+        ret[:keys] = [key_file] if key_file
+        ret[:password] = params["ssh_password"] if params["ssh_password"]
+        ret[:passphrase] = params["ssh_key_passphrase"] if params["ssh_key_passphrase"]
+        ret[:keys_only] = true
+        ret[:auth_methods] = auth_methods
+        ret[:verify_host_key] = true
+        ret[:number_of_password_prompts] = 1
+        ret
+      end
+    end
+  end
+end

data/lib/smart_proxy_remote_execution_ssh/plugin.rb

@@ -15,6 +15,7 @@ module Proxy::RemoteExecution::Ssh
     after_activation do
       require 'smart_proxy_dynflow'
       require 'smart_proxy_remote_execution_ssh/version'
+      require 'smart_proxy_remote_execution_ssh/cockpit'
       require 'smart_proxy_remote_execution_ssh/api'
 
       begin

data/lib/smart_proxy_remote_execution_ssh/version.rb

@@ -1,7 +1,7 @@
 module Proxy
   module RemoteExecution
     module Ssh
-      VERSION = '0.1.6'
+      VERSION = '0.3.2'
     end
   end
 end

data/lib/smart_proxy_remote_execution_ssh/webrick_ext.rb

@@ -0,0 +1,17 @@
+module SmartProxyRemoteExecutionSsh
+  module WEBrickExt
+    # An extension to ::WEBrick::HTTPRequest to expost the socket object for highjacking for cockpit
+    module HTTPRequestExt
+      def meta_vars
+        super.merge('ext.hijack!' => -> {
+                      # This stops Webrick from sending its own reply.
+                      @request_line = nil;
+                      # This stops Webrick from trying to read the next request on the socket.
+                      @keep_alive = false;
+                      return @socket;
+                    })
+      end
+    end
+  end
+  ::WEBrick::HTTPRequest.send(:prepend, WEBrickExt::HTTPRequestExt)
+end

data/settings.d/remote_execution_ssh.yml.example

@@ -10,3 +10,8 @@
 # for new data leave empty to use the runner's default
 # (1 second for regular, 60 seconds with async_ssh enabled)
 # :runner_refresh_interval:
+
+# Defines the verbosity of logging coming from Net::SSH
+# one of :debug, :info, :warn, :error, :fatal
+# must be lower than general log level
+# :ssh_log_level: fatal

metadata

@@ -1,43 +1,43 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_remote_execution_ssh
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.3.2
 platform: ruby
 authors:
 - Ivan Nečas
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-10-06 00:00:00.000000000 Z
+date: 2021-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -98,32 +98,45 @@ dependencies:
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.32.1
+        version: 0.82.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.32.1
+        version: 0.82.0
 - !ruby/object:Gem::Dependency
   name: smart_proxy_dynflow
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: '0.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
-description: |2
-      Ssh remote execution provider for Foreman Smart-Proxy
+        version: '0.1'
+- !ruby/object:Gem::Dependency
+  name: net-ssh
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: "    Ssh remote execution provider for Foreman Smart-Proxy\n"
 email:
 - inecas@redhat.com
 executables: []
@@ -137,15 +150,17 @@ files:
 - bundler.plugins.d/remote_execution_ssh.rb
 - lib/smart_proxy_remote_execution_ssh.rb
 - lib/smart_proxy_remote_execution_ssh/api.rb
+- lib/smart_proxy_remote_execution_ssh/cockpit.rb
 - lib/smart_proxy_remote_execution_ssh/http_config.ru
 - lib/smart_proxy_remote_execution_ssh/plugin.rb
 - lib/smart_proxy_remote_execution_ssh/version.rb
+- lib/smart_proxy_remote_execution_ssh/webrick_ext.rb
 - settings.d/remote_execution_ssh.yml.example
 homepage: https://github.com/theforeman/smart_proxy_remote_execution_ssh
 licenses:
-- GPLv3
+- GPL-3.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -160,9 +175,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.12
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Ssh remote execution provider for Foreman Smart-Proxy
 test_files: []