bdy 1.12.8-dev → 1.12.8-dev-pipeline-run

package/distTs/src/tunnel/server/ssh.js

@@ -1,464 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const events_1 = __importDefault(require("events"));
-const ssh2_1 = __importDefault(require("ssh2"));
-const logger_1 = __importDefault(require("../../logger"));
-const crypto_1 = require("crypto");
-const child_process_1 = require("child_process");
-const node_net_1 = __importDefault(require("node:net"));
-const sftp_1 = __importDefault(require("./sftp"));
-const buddy_1 = __importDefault(require("../api/buddy"));
-const pipeStreamToChannel = (stream, channel) => {
-    channel.once('exit', (code, signal) => {
-        logger_1.default.debug(`shell channel exit: ${code}, signal: ${signal}`);
-        if (stream.exit) {
-            if (signal)
-                stream.exit(signal);
-            else
-                stream.exit(code);
-        }
-    });
-    channel.on('close', () => {
-        stream.end();
-    });
-    channel.pipe(stream, { end: false }).pipe(channel);
-    channel.stderr.pipe(stream.stderr);
-};
-class ServerSsh extends events_1.default {
-    agent;
-    login;
-    password;
-    server;
-    constructor(agent, login, password, hostKey) {
-        super();
-        this.agent = agent;
-        this.login = login;
-        this.password = password;
-        this.server = new ssh2_1.default.Server({
-            hostKeys: [hostKey],
-            highWaterMark: 16 * 1024 * 1024,
-            ident: 'ssh2 server',
-        }, (client) => this.processClient(client));
-        this.server.listen();
-    }
-    stop() {
-        if (this.server) {
-            this.server.close();
-            this.server.removeAllListeners();
-        }
-        this.server = null;
-    }
-    handleSshTunnel(stream) {
-        if (this.server)
-            this.server.injectSocket(stream);
-    }
-    checkValueSafe(input, allowed) {
-        const autoReject = input.length !== allowed.length;
-        if (autoReject)
-            allowed = input;
-        const isMatch = (0, crypto_1.timingSafeEqual)(input, allowed);
-        return !autoReject && isMatch;
-    }
-    async verifyKey(ctx, keys) {
-        try {
-            for (let i = 0; i < keys.length; i += 1) {
-                const publicKey = ssh2_1.default.utils.parseKey(keys[i]);
-                if (publicKey instanceof Error)
-                    continue;
-                if (ctx.key.algo !== publicKey.type)
-                    continue;
-                if (!this.checkValueSafe(ctx.key.data, publicKey.getPublicSSH()))
-                    continue;
-                if (ctx.signature &&
-                    !publicKey.verify(ctx.blob || '', ctx.signature, ctx.hashAlgo))
-                    continue;
-                return true;
-            }
-        }
-        catch {
-            // do nothing
-        }
-        return false;
-    }
-    createProxyConnection(privateKey) {
-        return new Promise((resolve, reject) => {
-            const client = new ssh2_1.default.Client();
-            client.once('error', (err) => {
-                client.removeAllListeners();
-                reject(err);
-            });
-            client.once('ready', () => {
-                client.removeAllListeners();
-                resolve(client);
-            });
-            client.connect({
-                host: '127.0.0.1',
-                port: 22,
-                username: 'root',
-                privateKey: privateKey,
-            });
-        });
-    }
-    async authenticateClient(ctx) {
-        const allowed = ['publickey', 'password'];
-        logger_1.default.debug(`auth method: ${ctx.method}`);
-        if (!allowed.includes(ctx.method)) {
-            ctx.reject(allowed);
-            return null;
-        }
-        if (ctx.method === 'password') {
-            if (!this.checkValueSafe(Buffer.from(ctx.username), Buffer.from(this.login))) {
-                ctx.reject(allowed);
-                return null;
-            }
-            if (!this.checkValueSafe(Buffer.from(ctx.password), Buffer.from(this.password))) {
-                ctx.reject(allowed);
-                return null;
-            }
-            ctx.accept();
-            return;
-        }
-        if (ctx.method === 'publickey') {
-            let keys;
-            let privateKey;
-            try {
-                const resp = await buddy_1.default.fetchAgentKeys(this.agent.id, this.agent.host, this.agent.token);
-                logger_1.default.debug(resp);
-                keys = resp.keys;
-                privateKey = resp.privateKey;
-            }
-            catch {
-                ctx.reject(allowed);
-                return null;
-            }
-            const verified = await this.verifyKey(ctx, keys);
-            if (!verified) {
-                logger_1.default.debug('not verified');
-                ctx.reject(allowed);
-                return null;
-            }
-            logger_1.default.debug('verified');
-            try {
-                const proxyClient = await this.createProxyConnection(privateKey);
-                logger_1.default.debug('proxy connected');
-                ctx.accept();
-                return proxyClient;
-            }
-            catch (err) {
-                logger_1.default.debug('proxy not connected');
-                logger_1.default.debug(err);
-                ctx.reject(allowed);
-                return null;
-            }
-        }
-        ctx.reject(allowed);
-        return null;
-    }
-    localExec(stream, command, env) {
-        const s = process.hrtime();
-        const opts = {};
-        if (env)
-            opts.env = env;
-        (0, child_process_1.exec)(command, opts, (err, stdout, stderr) => {
-            if (stream) {
-                stream.stderr.write(stderr);
-                stream.write(stdout);
-                stream.exit(!err ? 0 : 1);
-                stream.end();
-            }
-            const [seconds, nano] = process.hrtime(s);
-            const ms = seconds * 1000 + nano / 1000 / 1000;
-            logger_1.default.debug(`local ssh exec ends: ${ms}ms`);
-        });
-    }
-    clientSession(session, client, proxyClient) {
-        let env = {};
-        let sftp;
-        let channel;
-        let pty;
-        let x11;
-        const closeSession = () => {
-            logger_1.default.debug('ssh close session');
-            env = null;
-            pty = null;
-            x11 = null;
-            session.removeAllListeners();
-            if (sftp) {
-                sftp.destroy();
-                sftp = null;
-            }
-            if (channel) {
-                channel.removeAllListeners();
-                channel = null;
-            }
-            client.removeListener('close', closeSession);
-        };
-        client.on('close', closeSession);
-        session.on('close', closeSession);
-        session.on('end', closeSession);
-        session.on('pty', (accept, reject, info) => {
-            logger_1.default.debug('ssh pty');
-            logger_1.default.debug(info);
-            if (!proxyClient) {
-                if (reject)
-                    reject();
-                return;
-            }
-            pty = info;
-            if (accept)
-                accept();
-        });
-        session.on('window-change', (accept, reject, info) => {
-            logger_1.default.debug('ssh window-change');
-            logger_1.default.debug(info);
-            if (!proxyClient) {
-                if (reject)
-                    reject();
-                return;
-            }
-            if (!pty)
-                pty = {};
-            pty.cols = info.cols;
-            pty.height = info.height;
-            pty.rows = info.rows;
-            pty.width = info.width;
-            if (channel && channel.setWindow)
-                channel.setWindow(pty.rows || 1, pty.cols || 1, pty.height || 1, pty.width || 1);
-            if (accept)
-                accept();
-        });
-        session.on('shell', (accept, reject) => {
-            logger_1.default.debug('ssh shell');
-            if (!proxyClient || !accept) {
-                if (reject)
-                    reject();
-                return;
-            }
-            const stream = accept();
-            const opts = {};
-            if (env)
-                opts.env = env;
-            if (x11)
-                opts.x11 = x11;
-            proxyClient.shell(pty || {}, opts, (err, c) => {
-                if (err || !c) {
-                    if (reject)
-                        reject();
-                    return;
-                }
-                pipeStreamToChannel(stream, c);
-            });
-        });
-        session.on('signal', (accept, reject, info) => {
-            logger_1.default.debug('ssh signal');
-            logger_1.default.debug(info);
-            const { name } = info;
-            if (!proxyClient || !name || !channel || !channel.signal) {
-                if (reject)
-                    reject();
-                return;
-            }
-            channel.signal(name);
-            if (accept)
-                accept();
-        });
-        session.on('subsystem', (accept, reject, info) => {
-            logger_1.default.debug('ssh subsystem');
-            logger_1.default.debug(info);
-            const { name } = info;
-            if (!proxyClient || !accept || !name) {
-                if (reject)
-                    reject();
-                return;
-            }
-            const stream = accept();
-            proxyClient.subsys(name, (err, c) => {
-                if (err || !c) {
-                    if (reject)
-                        reject();
-                    return;
-                }
-                pipeStreamToChannel(stream, c);
-            });
-        });
-        session.on('x11', (accept, reject, info) => {
-            logger_1.default.debug('ssh x11');
-            logger_1.default.debug(info);
-            if (!proxyClient) {
-                if (reject)
-                    reject();
-                return;
-            }
-            x11 = info;
-            if (accept)
-                accept();
-        });
-        session.on('exec', (accept, reject, info) => {
-            logger_1.default.debug('ssh exec');
-            logger_1.default.debug(info);
-            if (!info.command || !accept) {
-                if (reject)
-                    reject();
-                return;
-            }
-            const stream = accept();
-            if (!proxyClient) {
-                this.localExec(stream, info.command, env);
-                return;
-            }
-            const opts = {};
-            if (env)
-                opts.env = env;
-            if (pty)
-                opts.pty = pty;
-            if (x11)
-                opts.x11 = x11;
-            proxyClient.exec(info.command, opts, (err, c) => {
-                if (err || !c) {
-                    if (reject)
-                        reject();
-                    return;
-                }
-                pipeStreamToChannel(stream, c);
-            });
-        });
-        session.on('env', (accept, _, info) => {
-            logger_1.default.debug('ssh env');
-            logger_1.default.debug(info);
-            if (info.key) {
-                if (!env)
-                    env = {};
-                env[info.key] = info.val;
-            }
-            if (accept)
-                accept();
-        });
-        session.on('sftp', (accept, reject) => {
-            logger_1.default.debug('sftp');
-            if (!sftp && accept) {
-                sftp = new sftp_1.default(accept());
-            }
-            else if (reject) {
-                reject();
-            }
-        });
-    }
-    processClient(client) {
-        logger_1.default.debug('new ssh client');
-        let proxyClient;
-        client.setNoDelay();
-        client.on('authentication', async (ctx) => {
-            logger_1.default.debug('ssh authentication');
-            proxyClient = await this.authenticateClient(ctx);
-            if (proxyClient) {
-                proxyClient.on('tcp connection', (details, accept, reject) => {
-                    logger_1.default.debug('new ssh client forward connection');
-                    logger_1.default.debug(details);
-                    const { destIP, destPort, srcIP, srcPort } = details;
-                    client.forwardOut(destIP, destPort, srcIP, srcPort, (err, channel) => {
-                        logger_1.default.debug('new ssh client forward out connection');
-                        logger_1.default.debug({ destIP, destPort, srcIP, srcPort });
-                        if (err) {
-                            reject();
-                            return;
-                        }
-                        const stream = accept();
-                        channel.pipe(stream).pipe(channel);
-                    });
-                });
-            }
-        });
-        client.on('close', () => {
-            logger_1.default.debug('ssh close');
-            if (proxyClient) {
-                try {
-                    proxyClient.removeAllListeners();
-                    proxyClient.end();
-                }
-                catch {
-                    // do nothing
-                }
-                proxyClient = null;
-            }
-            setTimeout(() => {
-                client.removeAllListeners();
-                client = null;
-            }, 1000);
-        });
-        client.on('tcpip', (accept, reject, info) => {
-            logger_1.default.debug('ssh tcpip request');
-            logger_1.default.debug(info);
-            const { destIP, destPort } = info;
-            let accepted = false;
-            const socket = node_net_1.default.connect({
-                host: destIP,
-                port: destPort,
-            });
-            socket.on('connect', () => {
-                accepted = true;
-                const channel = accept();
-                channel.pipe(socket).pipe(channel);
-            });
-            const closeSocket = () => {
-                try {
-                    socket.removeAllListeners();
-                    socket.end();
-                }
-                catch {
-                    // do nothing
-                }
-                if (!accepted)
-                    reject();
-            };
-            socket.setTimeout(10000);
-            socket.on('timeout', closeSocket);
-            socket.on('error', closeSocket);
-            socket.on('close', closeSocket);
-        });
-        client.on('request', (accept, reject, name, info) => {
-            logger_1.default.debug('ssh forward request');
-            logger_1.default.debug(name);
-            logger_1.default.debug(info);
-            if (!proxyClient) {
-                reject();
-                return;
-            }
-            if (name === 'tcpip-forward') {
-                const { bindAddr, bindPort } = info;
-                proxyClient.forwardIn(bindAddr, bindPort, (err, port) => {
-                    if (err) {
-                        reject();
-                        return;
-                    }
-                    accept(port);
-                });
-                return;
-            }
-            if (name === 'cancel-tcpip-forward') {
-                const { bindAddr, bindPort } = info;
-                proxyClient.unforwardIn(bindAddr, bindPort, (err) => {
-                    if (err) {
-                        reject();
-                        return;
-                    }
-                    accept();
-                });
-                return;
-            }
-            reject();
-        });
-        client.on('error', (err) => {
-            logger_1.default.debug('Error on ssh server client');
-            logger_1.default.debug(err);
-            client.end();
-        });
-        client.on('session', (accept) => {
-            logger_1.default.debug('ssh session');
-            this.clientSession(accept(), client, proxyClient);
-        });
-    }
-}
-exports.default = ServerSsh;

package/distTs/src/tunnel/server/tls.js

@@ -1,47 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const events_1 = __importDefault(require("events"));
-const tls_1 = __importDefault(require("tls"));
-const cert_js_1 = __importDefault(require("./cert.js"));
-const tunnel_1 = require("../../types/tunnel");
-class ServerTls extends events_1.default {
-    key;
-    cert;
-    ca;
-    server;
-    constructor(key, cert, ca) {
-        super();
-        this.key = key;
-        this.cert = cert;
-        this.ca = ca;
-        if (!this.key || !this.cert) {
-            const c = new cert_js_1.default();
-            this.key = c.key;
-            this.cert = c.cert;
-        }
-        this.server = tls_1.default.createServer({
-            handshakeTimeout: 60000,
-            key: this.key,
-            cert: this.cert,
-            ca: this.ca || undefined,
-            rejectUnauthorized: !!this.ca,
-            requestCert: !!this.ca,
-        }, (socket) => this.processSocket(socket));
-    }
-    async processSocket(socket) {
-        this.emit(tunnel_1.TUNNEL_EVENT.TLS_SOCKET, socket);
-    }
-    handleSshTunnel(channel) {
-        if (this.server)
-            this.server.emit('connection', channel);
-    }
-    stop() {
-        if (this.server)
-            this.server.removeAllListeners();
-        this.server = null;
-    }
-}
-exports.default = ServerTls;