Millet Porridge

English version of https://corvo.myseu.cn

0%

OpenSSH Series (Extra 1) - Extended Use of ProxyCommand and Its Implementation Code

Posted on Edited on In Disqus:
While researching how ordinary users can access ssh services in a Kubernetes cluster, one solution was establishing a proxy server. I might as well read the related OpenSSH implementation code too.

Using the ProxyCommand Feature – Through an http Proxy

For the basics of this part see: OpenSSH Series (5) - Jumpserver and HTTP Proxy Usage

For complete usage see: Using a Proxy - HTTPProxy

1
2
# note: the nc here must be netcat-openbsd (the openbsd version of nc; gnu's nc has no -X feature)
ssh -o "ProxyCommand=nc -X connect -x 127.0.0.1:8888 %h %p" [email protected]

Source Code

There was really no need to read the source; I mainly wanted to know how ssh connects using a proxy. Below is the related code, with comments added to the important parts. It mainly uses the pipe feature from the POSIX standard: a child process is created to connect to the proxy server, then the parent process communicates with the child via stdin/stdout redirection, and can thus communicate with the remote server. This code isn’t hard, but I suggest reading it together with the NodeJS-implemented proxy server in the blog.

Code source: https://github.com/openssh/libopenssh

1
2
# search for the related code directly
find . -name "*.c" | xargs grep 'proxy_command' -n

You can see the related code is in ssh/sshconnect.c

1
2
3
4
5
// the ssh_connect function

/* If a proxy command is given, connect using it. */
if (proxy_command != NULL)
    return ssh_proxy_connect(host, port, proxy_command);
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
/*
 * Connect to the given ssh server using a proxy command.
 */
static struct ssh *
ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
{
    struct ssh *ssh;
    char *command_string, *tmp;
    int pin[2], pout[2];
    pid_t pid;
    char *shell, strport[NI_MAXSERV];

    if ((shell = getenv("SHELL")) == NULL || *shell == '\0')
        shell = _PATH_BSHELL;

    /* Convert the port number into a string. */
    snprintf(strport, sizeof strport, "%hu", port);

    /*
     * Build the final command string in the buffer by making the
     * appropriate substitutions to the given proxy command.
     *
     * Use "exec" to avoid "sh -c" processes on some platforms
     * (e.g. Solaris)
     */
    xasprintf(&tmp, "exec %s", proxy_command);
    command_string = percent_expand(tmp, "h", host, "p", strport,
        "r", options.user, (char *)NULL);
    xfree(tmp);

    // initialize two pipes
    /* Create pipes for communicating with the proxy. */
    if (pipe(pin) < 0 || pipe(pout) < 0)
        fatal("Could not create pipes to communicate with the proxy: %.100s",
            strerror(errno));

    debug("Executing proxy command: %.500s", command_string);

    /* Fork and execute the proxy command. */
    if ((pid = fork()) == 0) { // child process
        char *argv[10];

        /* Child.  Permanently give up superuser privileges. */
        permanently_drop_suid(original_real_uid);

        /* Redirect stdin and stdout. */
        close(pin[1]);
        if (pin[0] != 0) {
            // close the child's stdin; use pin[0] as stdin
            if (dup2(pin[0], 0) < 0)
                perror("dup2 stdin");
            close(pin[0]);
        }
        // close the child's stdout; use pout[1] as stdout
        close(pout[0]);
        if (dup2(pout[1], 1) < 0)
            perror("dup2 stdout");
        /* Cannot be 1 because pin allocated two descriptors. */
        close(pout[1]);

        /* Stderr is left as it is so that error messages get
           printed on the user's terminal. */
        argv[0] = shell;
        argv[1] = "-c";
        argv[2] = command_string;
        argv[3] = NULL;

        /* Execute the proxy command.  Note that we gave up any
           extra privileges above. */
        signal(SIGPIPE, SIG_DFL);
        // start the child process; the child will connect to the remote server
        execv(argv[0], argv);
        perror(argv[0]);
        exit(1);
    }
    /* Parent. */
    if (pid < 0)
        fatal("fork failed: %.100s", strerror(errno));
    else
        proxy_command_pid = pid; /* save pid to clean up later */

    /* Close child side of the descriptors. */
    close(pin[0]);
    close(pout[1]);

    /* Free the command name. */
    xfree(command_string);

    /* Set the connection file descriptors. */
    ssh = ssh_packet_set_connection(NULL, pout[0], pin[1]);
    ssh_packet_set_timeout(ssh, options.server_alive_interval,
        options.server_alive_count_max);

    /* Indicate OK return */
    return (ssh);
}
Related Posts