ssh_tunnel_proxy 1.0.0

package/.vscode/launch.json

@@ -0,0 +1,34 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "debug mocha",
+            "request": "launch",
+            "runtimeArgs": [
+                "run-script",
+                "test"
+            ],
+            "runtimeVersion": "19.4.0",
+            "runtimeExecutable": "npm",
+            "skipFiles": [
+                "<node_internals>/**"
+            ],
+            "type": "node"
+        },
+        {
+            "type": "node",
+            "runtimeVersion": "19.4.0",
+            "request": "launch",
+            "name": "Launch Program",
+            "cwd": "${fileDirname}",
+            "skipFiles": [
+                "<node_internals>/**"
+            ],
+            "program": "${file}",
+            "args":["--source=themagician_composite"]
+        }
+    ]
+}

package/lib/index.js

@@ -0,0 +1,284 @@
+/*
+
+ssh_tunnel_proxy - initiate a ssh reverse tunnel proxy with forwarding ports
+with connection optional ssh tunnel service ngrok
+
+ssh_tunnel_proxy can function as a stand-alone api or part of an electron_js app. To establish a ssh tunnel proxy a keypair is generated on the client and stored in the system keychain.
+If a ngrok api key is provided the ngrok api endpoint method is invoked to obtain the hostport of
+the tunnel. A list of port forwards is provided to the connect_api function and ports validated to
+restrict connections to system ports on the remote host to a set of pre-defined ports such as http,https.
+After establishing a ssh connection to the remote server, local proxy port forwards are opened. If
+the connection is interrupted then the ssh_connect method will attempt to re-establish the connection.
+
+Author: Autonomous
+First release: 1-29-2023
+License: MIT
+
+*/
+
+const net = require('net');
+const { EventEmitter } = require('node:events');
+const { Client } = require('electron-ssh2');
+
+const keypair_storage = require('./keypair_storage');
+const { get_hostport } = require('./ngrok_service');
+
+// emit events to enable hooks to be established during tunnel setup and error handling
+class SSHEmitter extends EventEmitter { };
+const sshEmitter = new SSHEmitter();
+
+// debugging options
+const debug = false;
+const debug_ssh = false;
+
+// storage for all open sockets on each server
+var listener = {};
+
+// function to close all active sockets for tunnel restart and exception handling
+const close_sockets = (server_name, proxy_ports) => {
+    if (!listener[server_name]) return;
+    proxy_ports.forEach(proxy_port => {
+        const server = listener[server_name][proxy_port];
+        if (server && server.listening) {
+            if (debug) console.log('closing server:', proxy_port)
+            server.close();
+        }
+    });
+}
+
+// ssh client debug function for verbose ssh connection details
+const debug_client = (debug_ssh) ? (msg) => { console.log(msg); } : null;
+
+// function to handle setting up tunnel and proxy forward ports
+const do_ssh_connect = (opts) => {
+
+    // close open sockets on server, otherwise initialize open sockets storage
+    if (listener[opts.server_name]) {
+        close_sockets(opts.server_name, opts.proxy_ports);
+    } else {
+        listener[opts.server_name] = {};
+    }
+
+    // create a new ssh client connection with supplied credentials and hostname/port
+    return new Promise((resolve, reject) => {
+
+        var listeners = 0;
+        const ssh_client = new Client();
+
+        // setup ssh client event listeners
+        ssh_client.on('end', () => {
+            if (debug) console.log('SSH Client :: end');
+            close_sockets(opts.server_name, opts.proxy_ports);
+        });
+        ssh_client.on('close', () => {
+            if (debug) console.log('SSH Client :: close');
+            close_sockets(opts.server_name, opts.proxy_ports);
+        });
+        ssh_client.on('error', err => {
+            if (debug) console.log('SSH Client :: error :: ' + err);
+            sshEmitter.emit('error', err);
+            close_sockets(opts.server_name, opts.proxy_ports);
+            ssh_retry_connect(opts);
+            resolve();
+        });
+        ssh_client.on('handshake', negotiated => {
+            if (debug) console.log('SSH Client :: handshake:', JSON.stringify(negotiated));
+        });
+        ssh_client.on('banner', (message, language) => {
+            if (debug) console.log('SSH Client :: banner:', message);
+        });
+
+        // when ssh client is ready, establish proxy forward ports to remote server
+        ssh_client.on('ready', () => {
+
+            // iterate through a list of local forward ports and create a local proxy port
+            opts.proxy_ports.forEach(proxy_port => {
+                const [local_port, remote_hostname, remote_port] = proxy_port.split(':');
+
+                // create local websocket server
+                listener[opts.server_name][proxy_port] = net.createServer({ keepAlive: true, allowHalfOpen: false }, socket => {
+
+                    if (debug) {
+                        var debug_msg = 'SSH Server :: connection on ' + local_port + ' ' + socket.remotePort;
+                        sshEmitter.emit('debug', debug_msg);
+                        console.log(debug_msg);
+                    }
+
+                    // create a proxy forward between the local port and remote port
+                    ssh_client.forwardOut(
+                        socket.remoteAddress,
+                        socket.remotePort,
+                        remote_hostname,
+                        remote_port,
+                        (err, stream) => {
+                            if (err) {
+                                sshEmitter.emit('error', err);
+                                if (debug) console.log('socket forward error:', err);
+                                //reject(err);
+                                return;
+                            }
+
+                            // pipe the data from the local socket to the remote port and visa versa
+                            socket.pipe(stream);
+                            stream.pipe(socket);
+
+                            // if socket ends, close stream and pipes
+                            socket.on('close', () => {
+                                stream.end();
+                            });
+
+                            // if socket error, emit error and close stream
+                            socket.on('error', (err) => {
+                                sshEmitter.emit('error', err);
+                                if (debug) console.log('socket on error:', err);
+                                stream.end();
+                            });
+
+                        }
+                    );
+                })
+
+                // start listening on port
+                listener[opts.server_name][proxy_port].listen(local_port, () => {
+
+                    // emit server listening on port message
+                    var status_msg = 'SSH Server :: bound on ' + local_port;
+                    sshEmitter.emit('status', status_msg, 'listening', local_port);
+
+                    // if all listeners have been successfully established, resolve setup connection
+                    if (listeners++ >= opts.proxy_ports.length - 1) {
+                        resolve();
+                    }
+                });
+            });
+        });
+
+        // initiate ssh client connection to remote host
+        ssh_client.connect({
+            host: opts.host,
+            port: opts.port,
+            username: opts.username,
+            password: opts.password,
+            privateKey: opts.private_key,
+            debug: debug_client,
+            keepaliveInterval: 10000
+        });
+    });
+}
+
+// validate port number - check for nan, out of valid port range, unauthorized system ports
+const validate_port_number = function (port_str, whitelist) {
+    if (isNaN(port_str)) return false;
+    const port = parseInt(port_str);
+    if (port < 1 || port > 65535) return false;
+    if (port < 1024 && whitelist[port] === undefined) return false;
+    return true;
+}
+
+// validate local forwards for correct format and valid ports
+const validate_local_forward = function (proxy_ports, whitelist) {
+    const local_ports = [];
+    const remote_ports = [];
+    proxy_ports.forEach(proxy_port => {
+        const [local_port, remote_hostname, remote_port] = proxy_port.split(':');
+        if (!validate_port_number(local_port, whitelist)) local_ports.push(local_port);
+        if (!validate_port_number(remote_port, whitelist)) remote_ports.push(remote_port);
+    });
+    if (local_ports.length || remote_ports.length) {
+        const err = new Error('Invalid local forward');
+        err.info = {
+            local_ports: local_ports.join(','),
+            remote_ports: remote_ports.join(',')
+        };
+        throw (err);
+    }
+    return true;
+}
+
+// on network error, attempt to re-establish connection until 10 retries
+let retries = 0;
+const ssh_retry_connect = (opts) => {
+    if (retries++ < 10) setTimeout(connect_ssh, 5000, opts);
+}
+
+// attempt to establish ssh tunnel to server with supplied parameters.
+const ssh_start_tunnel = async (opts) => {
+    return new Promise(async (resolve, reject) => {
+
+        // after successful tunnel setup complete, send events and reset retry counter
+        await do_ssh_connect(opts).then(() => {
+            const hostport = opts.host + ':' + opts.port;
+            const msg = 'SSH connection to ' + opts.server_name + ' established at ' + hostport;
+            if (debug) console.log(msg);
+            sshEmitter.emit('status', '', 'ready', hostport);
+            retries = 0;
+            resolve();
+        }, (err) => {
+            if (debug) console.log('ssh_retry error:', err);
+            reject();
+        });
+    });
+}
+
+// export function to setup ssh connection parameters and attempt to establish ssh tunnel
+// todo: if opts have changed while service is running, shutdown current service and restart with new opts
+const connect_ssh = async function (opts, whitelist) {
+    if (debug) {
+        console.log('connect_ssh:');
+        console.log(JSON.stringify(opts, null, 2));
+    }
+
+    // make deep copy of opts for modification
+    var _opts = JSON.parse(JSON.stringify(opts));
+
+    // setup whitelist from param or opts in case of error retry
+    _opts.whitelist = (whitelist !== undefined) ? whitelist : (_opts.whitelist) ? _opts.whitelist : {};
+
+    // validate local port forwards, emit error and quit if invalid
+    try {
+        validate_local_forward(_opts.proxy_ports, _opts.whitelist);
+    } catch (err) {
+        sshEmitter.emit('error', err);
+        if (debug) console.log(err);
+        return err;
+    }
+
+    // if password is empty set to undefined
+    if (opts.password && !opts.password.length) {
+        _opts.password = undefined;
+    }
+
+    // retrieve private key from system keychain with supplied service name and server
+    // if no key found, authentication is supplied username, password
+    _opts.private_key = await keypair_storage.retrieve_private_key(opts.service_name, opts.server_name);
+
+    // if ngrok api key provided, obtain hostname and hostport from ngrok api
+    // if no ngrok tunnel specified, use supplied host and port
+    if (_opts.ngrok_api) {
+        var hostport = await get_hostport(_opts.ngrok_api)
+            .catch((err) => {
+                if (debug) console.log('ngrok get_hostport connection error');
+                ssh_retry_connect(opts);
+            });
+        if (hostport && hostport.host) {
+            _opts.host = hostport.host;
+            _opts.port = hostport.port;
+        }
+        else return null;
+    }
+
+    // initiate ssh tunnel, block until tunnel is established or error
+    return await ssh_start_tunnel(_opts);
+}
+
+// export function to obtain ssh connection event emitter
+const get_event_hook = () => { return sshEmitter; }
+
+module.exports = {
+    connect_ssh: connect_ssh,
+    generate_and_store_keypair: keypair_storage.generate_and_store_keypair,
+    generate_keypair: keypair_storage.generate_keypair,
+    get_public_key: keypair_storage.get_public_key_from_keychain,
+    remove_keypair: keypair_storage.remove_keypair,
+    get_event_hook: get_event_hook
+}

package/lib/keypair_storage.js

@@ -0,0 +1,69 @@
+/*
+
+keypair_storage - generate and store keypairs in the system keychain
+
+keypair_storage provides a set of functions to generate ssh ed25519 keypairs. Private keys
+are stored in the system keychain and retrieved by service_name and server_name parameters.
+
+Author: Autonomous
+First release: 1-29-2023
+License: MIT
+
+*/
+
+const sshpk = require('sshpk');
+const keytar = require('keytar');
+
+// export function to generate keypair and store under service name and account
+const generate_and_store_keypair = (service_name, account) => {
+    const keypair = generate_keypair();
+    return new Promise((resolve, reject) => {
+        keytar.setPassword(service_name, account, keypair.private_key).then((result)=>{
+            resolve(keypair.public_key);
+        }, (err) => {
+            reject(err);
+        });
+    });
+}
+
+// export function to obtain public key from system's keychain stored under service_name and account
+const get_public_key_from_keychain = (service_name, account) => {
+    return new Promise((resolve, reject) => {
+        keytar.getPassword(service_name, account).then((private_key) => {
+            var public_key = get_public_key_from_private(private_key);
+            resolve(public_key);
+        }, (err) => {
+            reject(err);
+        });
+    });
+}
+
+const get_public_key_from_private = (private_key) => {
+    if (private_key) {
+        var key = sshpk.parsePrivateKey(private_key, 'pem');
+        if (key) return key.toPublic().toString('ssh');
+        else return null;
+    }
+    return null;
+}
+
+// generate EdDSA keypair
+const generate_keypair = () => {
+    // generate private key then obtain public key from private
+    // note: EdDSA is required for nodejs ssh
+    const privateKey = sshpk.generatePrivateKey('ed25519').toString('ssh');
+    const publicKey = get_public_key_from_private(privateKey);
+    return {
+        public_key: publicKey,
+        private_key: privateKey
+    };
+}
+
+module.exports = {
+    store_private_key: keytar.setPassword,
+    retrieve_private_key: keytar.getPassword,
+    remove_keypair: keytar.deletePassword,
+    generate_keypair: generate_keypair,
+    generate_and_store_keypair: generate_and_store_keypair,
+    get_public_key_from_keychain: get_public_key_from_keychain
+}

package/lib/ngrok_service.js

@@ -0,0 +1,36 @@
+/*
+
+ngrok_service - obtain hostport from ngrok api and split into host, port
+
+Author: Autonomous
+First release: 1-29-2023
+License: MIT
+
+*/
+
+// get endpoint hostname and hostport from ngrok api
+const { Ngrok } = require('@ngrok/ngrok-api');
+
+const get_ngrok_hostport = async function (ngrok_api) {
+    const ngrok = new Ngrok({ apiToken: ngrok_api });
+    var endpoints = await ngrok.endpoints.list();
+    return parse_ngrok_hostport(endpoints);
+}
+
+// retrieve hostport from api response
+const parse_ngrok_hostport = function (endpoints) {
+    if (endpoints[0] && endpoints[0].hostport) {
+        const hostport = endpoints[0].hostport.split(':');
+        var hostport_obj = {
+            host:hostport[0],
+            port:hostport[1]
+        }
+    } else {
+        throw (new Error('get_ngrok_hostport: no endpoints found'));
+    }
+    return hostport_obj;
+}
+
+module.exports = {
+    get_hostport: get_ngrok_hostport
+}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "ssh_tunnel_proxy",
+  "version": "1.0.0",
+  "description": "obtain ngrok host port from api and establish a ssh connection",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "mocha"
+  },
+  "author": "Autonomous",
+  "license": "MIT",
+  "dependencies": {
+    "@ngrok/ngrok-api": "^0.9.0",
+    "bluebird": "^3.7.2",
+    "crypto": "^1.0.1",
+    "electron-ssh2": "^0.1.2",
+    "form-data": "^4.0.0",
+    "fs": "^0.0.1-security",
+    "keytar": "^7.9.0",
+    "net": "^1.0.2",
+    "ngrok": "^4.3.3",
+    "socksv5": "^0.0.6",
+    "sshpk": "^1.17.0"
+  },
+  "devDependencies": {
+    "mocha": "^10.2.0",
+    "rewire": "^6.0.0",
+    "sinon": "^15.0.1"
+  }
+}

package/test/test.js

@@ -0,0 +1,234 @@
+/*
+todo:
+add generate and store keys test
+add ngrok api test with stored api key in ssh_tunnel_proxy config
+to run ssh tunnel api tests edit config.json and provide api keys for each service
+*/
+const assert = require('assert');
+const rewire = require('rewire');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const sinon = require('sinon');
+
+const { connect_ssh, get_event_hook } = require('../lib/index.js');
+const { store_private_key, retrieve_private_key, generate_and_store_keypair, get_public_key_from_keychain, remove_keypair, generate_keypair } = require('../lib/keypair_storage');
+const { get_hostport } = require('../lib/ngrok_service');
+
+var main = rewire('../lib/index.js');
+var ngrok_service = rewire('../lib/ngrok_service.js');
+var keypair_storage = rewire('../lib/keypair_storage.js');
+
+// get config file containing api keys
+var homedir = require('os').homedir();
+var opts = JSON.parse(fs.readFileSync(path.join(homedir, '.config/ssh_tunnel_proxy/config.json')), 'utf8');
+
+var myEmitter = get_event_hook();
+
+const whitelist = {
+  80: true,
+  443: true,
+  22: true
+}
+
+// port value validation tests
+describe('Validate ports', function () {
+  const validate_port_number = main.__get__('validate_port_number');
+  it('valid port number 1024', function () {
+    assert(validate_port_number(1024, whitelist), 'should be valid');
+  });
+  it('valid port number 80', function () {
+    assert(validate_port_number(80, whitelist), 'should be valid');
+  });
+  it('invalid port number -1', function () {
+    assert.equal(false, validate_port_number(-1, whitelist), 'should be invalid');
+  });
+  it('invalid port number 65536', function () {
+    assert.equal(false, validate_port_number(65536, whitelist), 'should be invalid');
+  });
+  it('invalid system port number 137', function () {
+    assert.equal(false, validate_port_number(137, whitelist), 'should be invalid');
+  });
+  it('port number nan', function () {
+    assert.equal(false, validate_port_number('nan', whitelist), 'should be invalid');
+  });
+});
+
+// local forward format and value validation test
+describe('Validate local forwards', function () {
+  const validate_local_forward = main.__get__('validate_local_forward');
+  var local_forward = [
+    '8080:127.0.0.1:80',
+    '9000:192.168.43.5:9000',
+    '9000:192.168.43.5',
+    '192.168.43.5:9000',
+    '8137:127.0.0.1:137',
+    '-1:127.0.0.1:65537',
+  ];
+  it('valid local forward to 80 ' + local_forward[0], function () {
+    assert(() => { return validate_local_forward([local_forward[0]], whitelist) }, 'should be valid');
+  });
+  it('valid local forward to 9000 ' + local_forward[1], function () {
+    assert(() => { return validate_local_forward([local_forward[1]], whitelist) }, 'should be valid');
+  });
+  it('invalid local forward format ' + local_forward[2], function () {
+    const err = {
+      message: 'Invalid local forward',
+      info: {
+        local_ports: '',
+        remote_ports: '',
+      }
+    };
+    assert.throws(() => { validate_local_forward([local_forward[2]], whitelist) }, err);
+  });
+  it('invalid local forward format ' + local_forward[3], function () {
+    const err = {
+      message: 'Invalid local forward',
+      info: {
+        local_ports: '192.168.43.5',
+        remote_ports: '',
+      }
+    };
+    assert.throws(() => { validate_local_forward([local_forward[3]], whitelist) }, err, 'should be invalid');
+  });
+  it('invalid local forward system port ' + local_forward[4], function () {
+    const err = {
+      message: 'Invalid local forward',
+      info: {
+        local_ports: '',
+        remote_ports: '137',
+      }
+    };
+    assert.throws(() => { validate_local_forward([local_forward[4]], whitelist) }, err, 'should be invalid');
+  });
+  it('invalid local forward port range ' + local_forward[5], function () {
+    const err = {
+      message: 'Invalid local forward',
+      info: {
+        local_ports: '-1',
+        remote_ports: '65537',
+      }
+    };
+    assert.throws(() => { validate_local_forward([local_forward[5]], whitelist) }, err, 'should be invalid');
+  });
+});
+
+// generate, store and retrieve private key test
+describe('Store and retrieve private key in system keychain', function () {
+  const service_name = 'ssh_proxy_tunnel';
+  const account = 'test';
+  const keypair = generate_keypair();
+  it('generated key should contain a private key', function () {
+    assert(keypair.private_key, 'should not be empty');
+  });
+  it('generated key should contain a public key', function () {
+    assert(keypair.public_key, 'should not be empty');
+  });
+  it('should store generated private key', () => {
+    return store_private_key(service_name, account, keypair.private_key).then(result => {
+      assert.equal(result, undefined, 'should not return error');
+    })
+  });
+  it('stored private key should match generated key', () => {
+    return retrieve_private_key(service_name, account).then(stored_key => {
+      assert.equal(stored_key, keypair.private_key, 'should match');
+    });
+  });
+  it('stored public key should match generated key', () => {
+    return get_public_key_from_keychain(service_name, account).then(stored_key => {
+      assert.equal(stored_key, keypair.public_key, 'should match');
+    });
+  });
+  it('remove key should return true', () => {
+    return remove_keypair(service_name, account).then(result => {
+      assert('should return true');
+    });
+  });
+  it('retrieve stored private key after delete should return null', () => {
+    return retrieve_private_key(service_name, account).then((result) => {
+      assert.equal(result, null, 'should return null');
+    });
+  });
+  it('retrieve stored public key after delete should return null', () => {
+    return get_public_key_from_keychain(service_name, account).then((result) => {
+      assert.equal(result, null, 'should return null');
+    });
+  });
+});
+
+/*
+// generate and store private key test
+describe('', function () {
+  it('', function () {
+    assert('', '');
+  });
+});
+*/
+
+describe('Get ngrok hostport', function () {
+  const parse_ngrok_hostport = ngrok_service.__get__('parse_ngrok_hostport');
+  var test_endpoint = [{
+    hostport: '8.tcp.ngrok.io:17632'
+  }];
+  var result_opts = parse_ngrok_hostport(test_endpoint, opts);
+  it('host should match 8.tcp.ngrok.io', function () {
+    assert.equal(result_opts.host, '8.tcp.ngrok.io');
+  });
+  it('port should match 17632', function () {
+    assert.equal(result_opts.port, '17632');
+  });
+  it('host, port should be obtained from api', ()=> {
+    get_hostport(opts).then((result) => {
+      assert(result.host,'host should exist');
+      assert(result.port,'port should exist');
+    }, (err)=>{
+      assert.equal(err,null);
+    });
+
+  });
+});
+
+/*
+describe('ssh connection client ready', function () {
+});
+
+it('myEmitter should be enabled', function () {
+  assert(myEmitter, 'received event emitter');
+});
+
+describe('ssh connection integration test', function () {
+
+  it('ssh connect should invoke the ssh ready function', function (done) {
+    this.timeout(10000);
+    myEmitter.on('ssh_client_ready', (ssh_client) => {
+      assert(ssh_client, 'ssh client created');
+      done();
+    });
+  });
+  var ws_socket = false;
+  it('two websocket servers should be created', function (done) {
+    this.timeout(18000);
+    myEmitter.on('websocket_server_created', (socket) => {
+      assert(socket, 'ssh websocket server created:' + socket.remotePort);
+      if (!ws_socket) done();
+      ws_socket = true;
+    });
+  });
+  connect_ssh(opts);
+
+});
+*/
+
+
+// test generate keypair
+var test_generate_keypair = function () {
+  const keypair = generate_keypair();
+  console.log('keypair:');
+  console.log(keypair.public_key);
+  console.log(keypair.private_key);
+  var homedir = os.homedir();
+  var fname = path.join(homedir, '.ssh', 'zm_id_rsa.pub')
+  //fs.writeFileSync(fname, keypair.public_key);
+  fname = path.join(homedir, '.ssh', 'zm_id_rsa')
+  //fs.writeFileSync(fname, keypair.private_key);
+}