@ -30,7 +30,8 @@ import (
"syscall" "syscall"
"time" "time"
gossh "golang.org/x/crypto/ssh" gliderssh "github.com/tailscale/gliderssh"
"golang.org/x/crypto/ssh"
"tailscale.com/envknob" "tailscale.com/envknob"
"tailscale.com/feature" "tailscale.com/feature"
"tailscale.com/ipn/ipnlocal" "tailscale.com/ipn/ipnlocal"
@ -38,7 +39,6 @@ import (
"tailscale.com/net/tsdial" "tailscale.com/net/tsdial"
"tailscale.com/sessionrecording" "tailscale.com/sessionrecording"
"tailscale.com/tailcfg" "tailscale.com/tailcfg"
"tailscale.com/tempfork/gliderlabs/ssh"
"tailscale.com/types/key" "tailscale.com/types/key"
"tailscale.com/types/logger" "tailscale.com/types/logger"
"tailscale.com/types/netmap" "tailscale.com/types/netmap"
@ -54,10 +54,10 @@ var (
sshDisableForwarding = envknob . RegisterBool ( "TS_SSH_DISABLE_FORWARDING" ) sshDisableForwarding = envknob . RegisterBool ( "TS_SSH_DISABLE_FORWARDING" )
sshDisablePTY = envknob . RegisterBool ( "TS_SSH_DISABLE_PTY" ) sshDisablePTY = envknob . RegisterBool ( "TS_SSH_DISABLE_PTY" )
// errTerminal is an empty go ssh.PartialSuccessError (with no 'Next'
// errTerminal is an empty ssh.PartialSuccessError (with no 'Next'
// authentication methods that may proceed), which results in the SSH
// authentication methods that may proceed), which results in the SSH
// server immediately disconnecting the client.
// server immediately disconnecting the client.
errTerminal = & go ssh. PartialSuccessError { } errTerminal = & ssh . PartialSuccessError { }
// hookSSHLoginSuccess is called after successful SSH authentication.
// hookSSHLoginSuccess is called after successful SSH authentication.
// It is set by platform-specific code (e.g., auditd_linux.go).
// It is set by platform-specific code (e.g., auditd_linux.go).
@ -204,7 +204,7 @@ func (srv *server) OnPolicyChange() {
} }
// conn represents a single SSH connection and its associated
// conn represents a single SSH connection and its associated
// ssh.Server.
// glider ssh.Server.
//
//
// During the lifecycle of a connection, the following are called in order:
// During the lifecycle of a connection, the following are called in order:
// Setup and discover server info
// Setup and discover server info
@ -220,9 +220,9 @@ func (srv *server) OnPolicyChange() {
// channels concurrently. At which point any of the following can be called
// channels concurrently. At which point any of the following can be called
// in any order.
// in any order.
// - c.handleSessionPostSSHAuth
// - c.handleSessionPostSSHAuth
// - c.mayForwardLocalPortTo followed by ssh.DirectTCPIPHandler
// - c.mayForwardLocalPortTo followed by glider ssh.DirectTCPIPHandler
type conn struct { type conn struct {
* ssh . Server * glider ssh. Server
srv * server srv * server
insecureSkipTailscaleAuth bool // used by tests.
insecureSkipTailscaleAuth bool // used by tests.
@ -234,9 +234,9 @@ type conn struct {
idH string idH string
connID string // ID that's shared with control
connID string // ID that's shared with control
// spac is a [go ssh.ServerPreAuthConn] used for sending auth banners.
// spac is a [ssh.ServerPreAuthConn] used for sending auth banners.
// Banners cannot be sent after auth completes.
// Banners cannot be sent after auth completes.
spac go ssh. ServerPreAuthConn spac ssh . ServerPreAuthConn
// The following fields are set during clientAuth and are used for policy
// The following fields are set during clientAuth and are used for policy
// evaluation and session management. They are immutable after clientAuth
// evaluation and session management. They are immutable after clientAuth
@ -280,7 +280,7 @@ func (c *conn) vlogf(format string, args ...any) {
// errDenied is returned by auth callbacks when a connection is denied by the
// errDenied is returned by auth callbacks when a connection is denied by the
// policy. It writes the message to an auth banner and then returns an empty
// policy. It writes the message to an auth banner and then returns an empty
// go ssh.PartialSuccessError in order to stop processing authentication
// ssh.PartialSuccessError in order to stop processing authentication
// attempts and immediately disconnect the client.
// attempts and immediately disconnect the client.
func ( c * conn ) errDenied ( message string ) error { func ( c * conn ) errDenied ( message string ) error {
if message == "" { if message == "" {
@ -293,7 +293,7 @@ func (c *conn) errDenied(message string) error {
} }
// errBanner writes the given message to an auth banner and then returns an
// errBanner writes the given message to an auth banner and then returns an
// empty go ssh.PartialSuccessError in order to stop processing authentication
// empty ssh.PartialSuccessError in order to stop processing authentication
// attempts and immediately disconnect the client. The contents of err is not
// attempts and immediately disconnect the client. The contents of err is not
// leaked in the auth banner, but it is logged to the server's log.
// leaked in the auth banner, but it is logged to the server's log.
func ( c * conn ) errBanner ( message string , err error ) error { func ( c * conn ) errBanner ( message string , err error ) error {
@ -308,7 +308,7 @@ func (c *conn) errBanner(message string, err error) error {
// errUnexpected is returned by auth callbacks that encounter an unexpected
// errUnexpected is returned by auth callbacks that encounter an unexpected
// error, such as being unable to send an auth banner. It sends an empty
// error, such as being unable to send an auth banner. It sends an empty
// go ssh.PartialSuccessError to tell go ssh.Server to stop processing
// ssh.PartialSuccessError to tell ssh.Server to stop processing
// authentication attempts and instead disconnect immediately.
// authentication attempts and instead disconnect immediately.
func ( c * conn ) errUnexpected ( err error ) error { func ( c * conn ) errUnexpected ( err error ) error {
c . logf ( "terminal error: %s" , err ) c . logf ( "terminal error: %s" , err )
@ -319,11 +319,11 @@ func (c *conn) errUnexpected(err error) error {
//
//
// If policy evaluation fails, it returns an error.
// If policy evaluation fails, it returns an error.
// If access is denied, it returns an error. This must always be an empty
// If access is denied, it returns an error. This must always be an empty
// go ssh.PartialSuccessError to prevent further authentication methods from
// ssh.PartialSuccessError to prevent further authentication methods from
// being tried.
// being tried.
func ( c * conn ) clientAuth ( cm go ssh. ConnMetadata ) ( perms * go ssh. Permissions , retErr error ) { func ( c * conn ) clientAuth ( cm ssh . ConnMetadata ) ( perms * ssh . Permissions , retErr error ) {
defer func ( ) { defer func ( ) {
if pse , ok := retErr . ( * go ssh. PartialSuccessError ) ; ok { if pse , ok := retErr . ( * ssh . PartialSuccessError ) ; ok {
if pse . Next . GSSAPIWithMICConfig != nil || if pse . Next . GSSAPIWithMICConfig != nil ||
pse . Next . KeyboardInteractiveCallback != nil || pse . Next . KeyboardInteractiveCallback != nil ||
pse . Next . PasswordCallback != nil || pse . Next . PasswordCallback != nil ||
@ -336,7 +336,7 @@ func (c *conn) clientAuth(cm gossh.ConnMetadata) (perms *gossh.Permissions, retE
} ( ) } ( )
if c . insecureSkipTailscaleAuth { if c . insecureSkipTailscaleAuth {
return & go ssh. Permissions { } , nil return & ssh . Permissions { } , nil
} }
if err := c . setInfo ( cm ) ; err != nil { if err := c . setInfo ( cm ) ; err != nil {
@ -384,7 +384,7 @@ func (c *conn) clientAuth(cm gossh.ConnMetadata) (perms *gossh.Permissions, retE
} }
c . finalAction = action c . finalAction = action
c . authCompleted . Store ( true ) c . authCompleted . Store ( true )
return & go ssh. Permissions { } , nil return & ssh . Permissions { } , nil
case action . Reject : case action . Reject :
metricTerminalReject . Add ( 1 ) metricTerminalReject . Add ( 1 )
c . finalAction = action c . finalAction = action
@ -417,14 +417,14 @@ func (c *conn) clientAuth(cm gossh.ConnMetadata) (perms *gossh.Permissions, retE
} }
} }
// ServerConfig implements ssh.ServerConfigCallback.
// ServerConfig implements glider ssh.ServerConfigCallback.
func ( c * conn ) ServerConfig ( ctx ssh . Context ) * go ssh. ServerConfig { func ( c * conn ) ServerConfig ( ctx glider ssh. Context ) * ssh . ServerConfig {
return & go ssh. ServerConfig { return & ssh . ServerConfig {
PreAuthConnCallback : func ( spac go ssh. ServerPreAuthConn ) { PreAuthConnCallback : func ( spac ssh . ServerPreAuthConn ) {
c . spac = spac c . spac = spac
} , } ,
NoClientAuth : true , // required for the NoClientAuthCallback to run
NoClientAuth : true , // required for the NoClientAuthCallback to run
NoClientAuthCallback : func ( cm go ssh. ConnMetadata ) ( * go ssh. Permissions , error ) { NoClientAuthCallback : func ( cm ssh . ConnMetadata ) ( * ssh . Permissions , error ) {
// First perform client authentication, which can potentially
// First perform client authentication, which can potentially
// involve multiple steps (for example prompting user to log in to
// involve multiple steps (for example prompting user to log in to
// Tailscale admin panel to confirm identity).
// Tailscale admin panel to confirm identity).
@ -438,10 +438,10 @@ func (c *conn) ServerConfig(ctx ssh.Context) *gossh.ServerConfig {
// specify a username ending in "+password" to force password auth.
// specify a username ending in "+password" to force password auth.
// The actual value of the password doesn't matter.
// The actual value of the password doesn't matter.
if strings . HasSuffix ( cm . User ( ) , forcePasswordSuffix ) { if strings . HasSuffix ( cm . User ( ) , forcePasswordSuffix ) {
return nil , & go ssh. PartialSuccessError { return nil , & ssh . PartialSuccessError {
Next : go ssh. ServerAuthCallbacks { Next : ssh . ServerAuthCallbacks {
PasswordCallback : func ( _ go ssh. ConnMetadata , password [ ] byte ) ( * go ssh. Permissions , error ) { PasswordCallback : func ( _ ssh . ConnMetadata , password [ ] byte ) ( * ssh . Permissions , error ) {
return & go ssh. Permissions { } , nil return & ssh . Permissions { } , nil
} , } ,
} , } ,
} }
@ -449,14 +449,14 @@ func (c *conn) ServerConfig(ctx ssh.Context) *gossh.ServerConfig {
return perms , nil return perms , nil
} , } ,
PasswordCallback : func ( cm go ssh. ConnMetadata , pword [ ] byte ) ( * go ssh. Permissions , error ) { PasswordCallback : func ( cm ssh . ConnMetadata , pword [ ] byte ) ( * ssh . Permissions , error ) {
// Some clients don't request 'none' authentication. Instead, they
// Some clients don't request 'none' authentication. Instead, they
// immediately supply a password. We humor them by accepting the
// immediately supply a password. We humor them by accepting the
// password, but authenticate as usual, ignoring the actual value of
// password, but authenticate as usual, ignoring the actual value of
// the password.
// the password.
return c . clientAuth ( cm ) return c . clientAuth ( cm )
} , } ,
PublicKeyCallback : func ( cm go ssh. ConnMetadata , key go ssh. PublicKey ) ( * go ssh. Permissions , error ) { PublicKeyCallback : func ( cm ssh . ConnMetadata , key ssh . PublicKey ) ( * ssh . Permissions , error ) {
// Some clients don't request 'none' authentication. Instead, they
// Some clients don't request 'none' authentication. Instead, they
// immediately supply a public key. We humor them by accepting the
// immediately supply a public key. We humor them by accepting the
// key, but authenticate as usual, ignoring the actual content of
// key, but authenticate as usual, ignoring the actual content of
@ -479,9 +479,9 @@ func (srv *server) newConn() (*conn, error) {
c := & conn { srv : srv } c := & conn { srv : srv }
now := srv . now ( ) now := srv . now ( )
c . connID = fmt . Sprintf ( "ssh-conn-%s-%02x" , now . UTC ( ) . Format ( "20060102T150405" ) , randBytes ( 5 ) ) c . connID = fmt . Sprintf ( "ssh-conn-%s-%02x" , now . UTC ( ) . Format ( "20060102T150405" ) , randBytes ( 5 ) )
fwdHandler := & ssh . ForwardedTCPHandler { } fwdHandler := & glider ssh. ForwardedTCPHandler { }
streamLocalFwdHandler := & ssh . ForwardedUnixHandler { } streamLocalFwdHandler := & glider ssh. ForwardedUnixHandler { }
c . Server = & ssh . Server { c . Server = & glider ssh. Server {
Version : "Tailscale" , Version : "Tailscale" ,
ServerConfigCallback : c . ServerConfig , ServerConfigCallback : c . ServerConfig ,
@ -492,14 +492,14 @@ func (srv *server) newConn() (*conn, error) {
LocalUnixForwardingCallback : c . mayForwardLocalUnixTo , LocalUnixForwardingCallback : c . mayForwardLocalUnixTo ,
ReverseUnixForwardingCallback : c . mayReverseUnixForwardTo , ReverseUnixForwardingCallback : c . mayReverseUnixForwardTo ,
SubsystemHandlers : map [ string ] ssh . SubsystemHandler { SubsystemHandlers : map [ string ] glider ssh. SubsystemHandler {
"sftp" : c . handleSessionPostSSHAuth , "sftp" : c . handleSessionPostSSHAuth ,
} , } ,
ChannelHandlers : map [ string ] ssh . ChannelHandler { ChannelHandlers : map [ string ] glider ssh. ChannelHandler {
"direct-tcpip" : ssh . DirectTCPIPHandler , "direct-tcpip" : glider ssh. DirectTCPIPHandler ,
"direct-streamlocal@openssh.com" : ssh . DirectStreamLocalHandler , "direct-streamlocal@openssh.com" : glider ssh. DirectStreamLocalHandler ,
} , } ,
RequestHandlers : map [ string ] ssh . RequestHandler { RequestHandlers : map [ string ] glider ssh. RequestHandler {
"tcpip-forward" : fwdHandler . HandleSSHRequest , "tcpip-forward" : fwdHandler . HandleSSHRequest ,
"cancel-tcpip-forward" : fwdHandler . HandleSSHRequest , "cancel-tcpip-forward" : fwdHandler . HandleSSHRequest ,
"streamlocal-forward@openssh.com" : streamLocalFwdHandler . HandleSSHRequest , "streamlocal-forward@openssh.com" : streamLocalFwdHandler . HandleSSHRequest ,
@ -507,9 +507,9 @@ func (srv *server) newConn() (*conn, error) {
} , } ,
} }
ss := c . Server ss := c . Server
maps . Copy ( ss . RequestHandlers , ssh . DefaultRequestHandlers ) maps . Copy ( ss . RequestHandlers , glider ssh. DefaultRequestHandlers )
maps . Copy ( ss . ChannelHandlers , ssh . DefaultChannelHandlers ) maps . Copy ( ss . ChannelHandlers , glider ssh. DefaultChannelHandlers )
maps . Copy ( ss . SubsystemHandlers , ssh . DefaultSubsystemHandlers ) maps . Copy ( ss . SubsystemHandlers , glider ssh. DefaultSubsystemHandlers )
keys , err := getHostKeys ( srv . lb . TailscaleVarRoot ( ) , srv . logf ) keys , err := getHostKeys ( srv . lb . TailscaleVarRoot ( ) , srv . logf )
if err != nil { if err != nil {
return nil , err return nil , err
@ -523,7 +523,7 @@ func (srv *server) newConn() (*conn, error) {
// mayReversePortPortForwardTo reports whether the ctx should be allowed to port forward
// mayReversePortPortForwardTo reports whether the ctx should be allowed to port forward
// to the specified host and port.
// to the specified host and port.
// TODO(bradfitz/maisem): should we have more checks on host/port?
// TODO(bradfitz/maisem): should we have more checks on host/port?
func ( c * conn ) mayReversePortForwardTo ( ctx ssh . Context , destinationHost string , destinationPort uint32 ) bool { func ( c * conn ) mayReversePortForwardTo ( ctx glider ssh. Context , destinationHost string , destinationPort uint32 ) bool {
if sshDisableForwarding ( ) { if sshDisableForwarding ( ) {
return false return false
} }
@ -537,7 +537,7 @@ func (c *conn) mayReversePortForwardTo(ctx ssh.Context, destinationHost string,
// mayForwardLocalPortTo reports whether the ctx should be allowed to port forward
// mayForwardLocalPortTo reports whether the ctx should be allowed to port forward
// to the specified host and port.
// to the specified host and port.
// TODO(bradfitz/maisem): should we have more checks on host/port?
// TODO(bradfitz/maisem): should we have more checks on host/port?
func ( c * conn ) mayForwardLocalPortTo ( ctx ssh . Context , destinationHost string , destinationPort uint32 ) bool { func ( c * conn ) mayForwardLocalPortTo ( ctx glider ssh. Context , destinationHost string , destinationPort uint32 ) bool {
if sshDisableForwarding ( ) { if sshDisableForwarding ( ) {
return false return false
} }
@ -548,42 +548,44 @@ func (c *conn) mayForwardLocalPortTo(ctx ssh.Context, destinationHost string, de
return false return false
} }
// mayForwardLocalUnixTo reports whether the ctx should be allowed to forward
// mayForwardLocalUnixTo is the server-side handler for
// to the specified Unix domain socket path. This is the server-side handler for
// direct-streamlocal@openssh.com (SSH -L with Unix sockets). It returns a
// direct-streamlocal@openssh.com (SSH -L with Unix sockets).
// connection to the specified Unix domain socket path if forwarding is
func ( c * conn ) mayForwardLocalUnixTo ( ctx ssh . Context , socketPath string ) ( net . Conn , error ) { // permitted, or an error if not.
func ( c * conn ) mayForwardLocalUnixTo ( ctx gliderssh . Context , socketPath string ) ( net . Conn , error ) {
if sshDisableForwarding ( ) { if sshDisableForwarding ( ) {
return nil , ssh . ErrRejected return nil , glider ssh. ErrRejected
} }
if c . finalAction != nil && c . finalAction . AllowLocalPortForwarding { if c . finalAction != nil && c . finalAction . AllowLocalPortForwarding {
metricLocalPortForward . Add ( 1 ) metricLocalPortForward . Add ( 1 )
cb := ssh . NewLocalUnixForwardingCallback ( c . unixForwardingOptions ( ) ) cb := glider ssh. NewLocalUnixForwardingCallback ( c . unixForwardingOptions ( ) )
return cb ( ctx , socketPath ) return cb ( ctx , socketPath )
} }
return nil , ssh . ErrRejected return nil , glider ssh. ErrRejected
} }
// mayReverseUnixForwardTo reports whether the ctx should be allowed to create
// mayReverseUnixForwardTo is the server-side handler for
// a reverse Unix domain socket forward. This is the server-side handler for
// streamlocal-forward@openssh.com (SSH -R with Unix sockets). It returns a
// streamlocal-forward@openssh.com (SSH -R with Unix sockets).
// listener for the specified Unix domain socket path if reverse forwarding is
func ( c * conn ) mayReverseUnixForwardTo ( ctx ssh . Context , socketPath string ) ( net . Listener , error ) { // permitted, or an error if not.
func ( c * conn ) mayReverseUnixForwardTo ( ctx gliderssh . Context , socketPath string ) ( net . Listener , error ) {
if sshDisableForwarding ( ) { if sshDisableForwarding ( ) {
return nil , ssh . ErrRejected return nil , glider ssh. ErrRejected
} }
if c . finalAction != nil && c . finalAction . AllowRemotePortForwarding { if c . finalAction != nil && c . finalAction . AllowRemotePortForwarding {
metricRemotePortForward . Add ( 1 ) metricRemotePortForward . Add ( 1 )
cb := ssh . NewReverseUnixForwardingCallback ( c . unixForwardingOptions ( ) ) cb := glider ssh. NewReverseUnixForwardingCallback ( c . unixForwardingOptions ( ) )
return cb ( ctx , socketPath ) return cb ( ctx , socketPath )
} }
return nil , ssh . ErrRejected return nil , glider ssh. ErrRejected
} }
// unixForwardingOptions returns the Unix forwarding options scoped to the
// unixForwardingOptions returns the Unix forwarding options scoped to the
// authenticated local user. Socket paths are restricted to the user's home
// authenticated local user. Socket paths are restricted to the user's home
// directory, /tmp, and /run/user/<uid>.
// directory, /tmp, and /run/user/<uid>.
func ( c * conn ) unixForwardingOptions ( ) ssh . UnixForwardingOptions { func ( c * conn ) unixForwardingOptions ( ) glider ssh. UnixForwardingOptions {
return ssh . UnixForwardingOptions { return glider ssh. UnixForwardingOptions {
AllowedDirectories : ssh . UserSocketDirectories ( c . localUser . HomeDir , c . localUser . Uid ) , AllowedDirectories : glider ssh. UserSocketDirectories ( c . localUser . HomeDir , c . localUser . Uid ) ,
BindUnlink : true , BindUnlink : true ,
} }
} }
@ -635,7 +637,7 @@ func toIPPort(a net.Addr) (ipp netip.AddrPort) {
// connInfo populates the sshConnInfo from the provided arguments,
// connInfo populates the sshConnInfo from the provided arguments,
// validating only that they represent a known Tailscale identity.
// validating only that they represent a known Tailscale identity.
func ( c * conn ) setInfo ( cm go ssh. ConnMetadata ) error { func ( c * conn ) setInfo ( cm ssh . ConnMetadata ) error {
if c . info != nil { if c . info != nil {
return nil return nil
} }
@ -685,7 +687,7 @@ func (c *conn) evaluatePolicy() (_ *tailcfg.SSHAction, localUser string, acceptE
// handleSessionPostSSHAuth runs an SSH session after the SSH-level authentication,
// handleSessionPostSSHAuth runs an SSH session after the SSH-level authentication,
// but not necessarily before all the Tailscale-level extra verification has
// but not necessarily before all the Tailscale-level extra verification has
// completed. It also handles SFTP requests.
// completed. It also handles SFTP requests.
func ( c * conn ) handleSessionPostSSHAuth ( s ssh . Session ) { func ( c * conn ) handleSessionPostSSHAuth ( s glider ssh. Session ) {
// Do this check after auth, but before starting the session.
// Do this check after auth, but before starting the session.
switch s . Subsystem ( ) { switch s . Subsystem ( ) {
case "sftp" : case "sftp" :
@ -734,7 +736,7 @@ func (c *conn) expandDelegateURLLocked(actionURL string) string {
// sshSession is an accepted Tailscale SSH session.
// sshSession is an accepted Tailscale SSH session.
type sshSession struct { type sshSession struct {
ssh . Session glider ssh. Session
sharedID string // ID that's shared with control
sharedID string // ID that's shared with control
logf logger . Logf logf logger . Logf
@ -748,7 +750,7 @@ type sshSession struct {
wrStdin io . WriteCloser wrStdin io . WriteCloser
rdStdout io . ReadCloser rdStdout io . ReadCloser
rdStderr io . ReadCloser // rdStderr is nil for pty sessions
rdStderr io . ReadCloser // rdStderr is nil for pty sessions
ptyReq * ssh . Pty // non-nil for pty sessions
ptyReq * glider ssh. Pty // non-nil for pty sessions
// childPipes is a list of pipes that need to be closed when the process exits.
// childPipes is a list of pipes that need to be closed when the process exits.
// For pty sessions, this is the tty fd.
// For pty sessions, this is the tty fd.
@ -772,7 +774,7 @@ func (ss *sshSession) vlogf(format string, args ...any) {
} }
} }
func ( c * conn ) newSSHSession ( s ssh . Session ) * sshSession { func ( c * conn ) newSSHSession ( s glider ssh. Session ) * sshSession {
sharedID := fmt . Sprintf ( "sess-%s-%02x" , c . srv . now ( ) . UTC ( ) . Format ( "20060102T150405" ) , randBytes ( 5 ) ) sharedID := fmt . Sprintf ( "sess-%s-%02x" , c . srv . now ( ) . UTC ( ) . Format ( "20060102T150405" ) , randBytes ( 5 ) )
c . logf ( "starting session: %v" , sharedID ) c . logf ( "starting session: %v" , sharedID )
ctx , cancel := context . WithCancelCause ( s . Context ( ) ) ctx , cancel := context . WithCancelCause ( s . Context ( ) )
@ -907,10 +909,10 @@ func (c *conn) detachSession(ss *sshSession) {
var errSessionDone = errors . New ( "session is done" ) var errSessionDone = errors . New ( "session is done" )
// handleSSHAgentForwarding starts a Unix socket listener and in the background
// handleSSHAgentForwarding starts a Unix socket listener and in the background
// forwards agent connections between the listener and the ssh.Session.
// forwards agent connections between the listener and the glider ssh.Session.
// On success, it assigns ss.agentListener.
// On success, it assigns ss.agentListener.
func ( ss * sshSession ) handleSSHAgentForwarding ( s ssh . Session , lu * userMeta ) error { func ( ss * sshSession ) handleSSHAgentForwarding ( s glider ssh. Session , lu * userMeta ) error {
if ! ssh . AgentRequested ( ss ) || ! ss . conn . finalAction . AllowAgentForwarding { if ! glider ssh. AgentRequested ( ss ) || ! ss . conn . finalAction . AllowAgentForwarding {
return nil return nil
} }
if sshDisableForwarding ( ) { if sshDisableForwarding ( ) {
@ -920,7 +922,7 @@ func (ss *sshSession) handleSSHAgentForwarding(s ssh.Session, lu *userMeta) erro
return nil return nil
} }
ss . logf ( "ssh: agent forwarding requested" ) ss . logf ( "ssh: agent forwarding requested" )
ln , err := ssh . NewAgentListener ( ) ln , err := glider ssh. NewAgentListener ( )
if err != nil { if err != nil {
return err return err
} }
@ -952,7 +954,7 @@ func (ss *sshSession) handleSSHAgentForwarding(s ssh.Session, lu *userMeta) erro
return err return err
} }
go ssh . ForwardAgentConnections ( ln , s ) go glider ssh. ForwardAgentConnections ( ln , s )
ss . agentListener = ln ss . agentListener = ln
return nil return nil
} }
@ -1325,7 +1327,7 @@ func (ss *sshSession) startNewRecording() (_ *recording, err error) {
} }
} }
var w ssh . Window var w glider ssh. Window
if ptyReq , _ , isPtyReq := ss . Pty ( ) ; isPtyReq { if ptyReq , _ , isPtyReq := ss . Pty ( ) ; isPtyReq {
w = ptyReq . Window w = ptyReq . Window
} }
Kristoffer Dalby
1 month ago
committed by
Kristoffer Dalby